OS Command Injection in pulverizr
pulverizr through 0.7.0 allows execution of arbitrary commands. Within `lib/job.js`, the variable `filename` can be controlled by the attacker. This function uses the variable &quot;filename&quot; to construct the argument of the exec call without any sanitization. In order to successfully exploit this vulnerability, an attacker will need to create a new file with the same name as the attack command.