child_process shell input

Never pass unsanitized user input to exec(), string-based execSync(), or execFile() with shell enabled. Shell-backed calls look interchangeable with direct spawning, but metacharacters enable command execution; use spawn()/execFile() or execFileSync() with shell: false and array arguments.