Blitz.js framework vulnerability