Werkzeug has a debug console that requires a pin by default. It's possible to bypass this with an LFI vulnerability or use it as a local privilege escalation vector ...

Start a JS debug session Click on the code lens to view and edit the runtime value of the property. This can be done while the debug session is paused or running ...