Versions of the package network before 0.7.0 are vulnerable to Arbitrary Command Injection due to use of the child_process exec function without input sanitization.
CVSS 3.1CRITICAL 9.8·Network·No auth·No interaction·EPSS 0.03302·Published 2024-01-30·Fixed in 0.7.0CWE-77
