It executes the received JavaScript code directly via new Function(). The called code has the same rights as the host process, so it usually has direct access to the file system and network traffic.