description: npm-programmatic through 0.0.12 is vulnerable to Command Injection.The packages and option properties are concatenated together without any validation and are used by the 'exec' function directly.
problem types: Command Injection
affected:
{
product: npm-programmatic
vendor: n/a
versions:
status: affected, version: All versions including 0.0.12
}