#NodeJS

High-severity OS command injection in protobufjs-cli's pbts tool. User-supplied file paths are string-interpolated into a shell command and executed via child_process.exec(), enabling arbitrary command execution via crafted filenames.