It's shame that the author has no idea about the security model of WebAssembly. Control-flow integrity and protected call stacks prevents direct code injection attacks in WebAssembly. Please check. https://webassembly.org/docs/security/