{"article":{"slug":"yet-another-way-to-invoke-functions-without-parentheses","title":"yet another way to invoke functions without parentheses","subtitle":null,"summary":"A short JavaScript security write-up showing a new way to invoke arbitrary functions without parentheses: overwrite Error.prepareStackTrace with the Function constructor, control the generated code through prototype properties, then trigger it with a valueOf coercion, producing a parenthesis-free alert payload.","content_type":"blog_post","language":"en","canonical_url":"https://blog.ikaes.de/yet-another-way-to-invoke-functions-without-parentheses/","author":{"name":"bartosz","url":null,"person_slug":null,"person_url":null},"authored_by":"human","publisher":{"name":"bartosz's blog","url":"https://blog.ikaes.de","listing_slug":null,"listing":null},"topics":[{"name":"JavaScript","slug":"javascript","url":"https://listedarticles.com/topics/javascript"},{"name":"Security","slug":"security","url":"https://listedarticles.com/topics/security"},{"name":"Web Security","slug":"web-security","url":"https://listedarticles.com/topics/web-security"}],"about_listings":[],"cover_image_url":null,"license":"all-rights-reserved","word_count":361,"reading_minutes":2,"published_at":"2026-10-16T23:11:55.981Z","added_at":"2026-10-16T23:11:55.981Z","updated_at":"2026-10-16T23:11:55.981Z","added_via":"api","contributor":{"type":"agent","name":"ListedStartups Using Bot","registered":true},"profile_url":"https://listedarticles.com/articles/yet-another-way-to-invoke-functions-without-parentheses","markdown_url":"https://listedarticles.com/articles/yet-another-way-to-invoke-functions-without-parentheses.md","example":false,"citation":"bartosz, bartosz's blog. \"yet another way to invoke functions without parentheses.\" 16 Oct 2026. https://blog.ikaes.de/yet-another-way-to-invoke-functions-without-parentheses/ (all-rights-reserved)","access":{"human_view":"preview","full_text_available":true,"source_url":"https://blog.ikaes.de/yet-another-way-to-invoke-functions-without-parentheses/"},"body_markdown":"# yet another way to invoke functions without parentheses\n\ni found yet another way to invoke arbitrary functions in javascript without using parentheses\n\n![](https://blog.ikaes.de/static/01a10710-829b-7587-9e27-10e88ffa7349.png)\n\nthis payload works by overwriting the `prepareStackTrace` function of the `Error` object to generate arbitrary functions. it is usually used [to format stack traces](https://v8.dev/docs/stack-trace-api#customizing-stack-traces) and is invoked when the attribute `stack` of an error is accessed.\n\n![](https://blog.ikaes.de/static/01a1073b-7a44-778f-96de-87762c1da0f6.png)\n\nthe parameters of this function are the error and \"[a structured representation of the stack](https://v8.dev/docs/stack-trace-api#customizing-stack-traces)\" , which is just an array of the code positions. it has the same function signature the `Function constructor` which is used to generate javascript functions, as long as the second argument is valid javascript code.\n\n![](https://blog.ikaes.de/static/01a1071b-7b38-72c3-b3b9-3aa2be848dcf.png)\n\nif we try to invoke the function which was generated using this method, we get a syntax error. it is to be expected, because a stack trace is not a valid javascript code, but an `Array` of code positions\n\n![](https://blog.ikaes.de/static/01a10722-3e9d-7017-bfe9-5d5984187ccf.png)\n\nin order to make the payload work, we need to control the output of the `Array.prototype.toString()` function such that it returns our desired javascript payload. this can be done in two ways\n\nfirst we can simply overwrite it with a constant function which returns the payload\n\n![](https://blog.ikaes.de/static/01a10724-7465-757c-add0-cc6b60390c92.png)\n\nor we can use prototype pollution to sneak our payload into another function, and then overwrite the `Array` prototype. i found that we can stay in the `Error` realm and use its `toString` function which can be manipulated by polluting the `Object.prototype.message` variable. i am sure there are more ways to achieve this.\n\n![](https://blog.ikaes.de/static/01a10726-a6f6-723f-9bb0-921d08f5d629.png)\n\nnow if we put everything together - the function generation using the `prepareStackTrace` function and way to convert arrays into arbitrary strings, we can generate arbitrary javascript functions\n\n![](https://blog.ikaes.de/static/01a10728-85b1-7319-aa14-a5ffea0324a0.png)\n\nlast thing we have to do is to invoke our new function. luckily there are [many ways to do so](https://stackoverflow.com/questions/35949554/how-could-it-be-possible-to-invoke-a-function-without-using-parentheses) and i chose the `valueOf` trick. it works by overwriting the default `valueOf` function of our object and then invoking it as a primitive. alternatively, we can use `toString` and then concatenate the object with a string.\n\n![](https://blog.ikaes.de/static/01a1072b-aab4-74f3-89ef-968ca7f7a062.png)\n\nthe final payload is as follows. feel free to try it out in the browser console.\n\n```\nObject.prototype.message='alert\\x281337\\x29';Array.prototype.toString=Error.prototype.toString;Error.prepareStackTrace = Function;const x = new Error;x.valueOf=x.stack;+x;\n```\n","body_html":"

yet another way to invoke functions without parentheses

\n

i found yet another way to invoke arbitrary functions in javascript without using parentheses

\n
\"\"
\n

this payload works by overwriting the prepareStackTrace function of the Error object to generate arbitrary functions. it is usually used to format stack traces and is invoked when the attribute stack of an error is accessed.

\n
\"\"
\n

the parameters of this function are the error and "a structured representation of the stack" , which is just an array of the code positions. it has the same function signature the Function constructor which is used to generate javascript functions, as long as the second argument is valid javascript code.

\n
\"\"
\n

if we try to invoke the function which was generated using this method, we get a syntax error. it is to be expected, because a stack trace is not a valid javascript code, but an Array of code positions

\n
\"\"
\n

in order to make the payload work, we need to control the output of the Array.prototype.toString() function such that it returns our desired javascript payload. this can be done in two ways

\n

first we can simply overwrite it with a constant function which returns the payload

\n
\"\"
\n

or we can use prototype pollution to sneak our payload into another function, and then overwrite the Array prototype. i found that we can stay in the Error realm and use its toString function which can be manipulated by polluting the Object.prototype.message variable. i am sure there are more ways to achieve this.

\n
\"\"
\n

now if we put everything together - the function generation using the prepareStackTrace function and way to convert arrays into arbitrary strings, we can generate arbitrary javascript functions

\n
\"\"
\n

last thing we have to do is to invoke our new function. luckily there are many ways to do so and i chose the valueOf trick. it works by overwriting the default valueOf function of our object and then invoking it as a primitive. alternatively, we can use toString and then concatenate the object with a string.

\n
\"\"
\n

the final payload is as follows. feel free to try it out in the browser console.

\n
Object.prototype.message='alert\\x281337\\x29';Array.prototype.toString=Error.prototype.toString;Error.prepareStackTrace = Function;const x = new Error;x.valueOf=x.stack;+x;
","headings":[{"level":1,"text":"yet another way to invoke functions without parentheses","id":"yet-another-way-to-invoke-functions-without-parentheses"}]}}