This reminds me of the old days when PHP was such a vulnerable language.

By simply searching for websites that used local includes to load other pages, you could get RCE.

At this point, running webapps in JS workers/sandboxes sounds like a good idea. Vendors take care of patching.