Powershell

How Command Injection happens in Node.js child_process calls and how to fix it

A high-severity command injection vulnerability was discovered in `bin/index.js` of a Node.js application, where the `createWindowsShortcut` function passed a user-controllable `destDir` argument directly into a dynamically constructed PowerShell command string. The fix eliminates the string interpolation entirely by moving all path data into environment variables and using `execFileSync` with a static script, removing any possibility of shell metacharacter injection. This is a textbook example