#SupplyChain

High-severity OS command injection in protobufjs-cli's pbts tool. User-supplied file paths are string-interpolated into a shell command and executed via child_process.exec(), enabling arbitrary command execution via crafted filenames.

High-severity OS command injection in uniget CLI where the check field from JSON metadata is passed directly to /bin/bash -c without validation, enabling arbitrary command execution via crafted metadata files.