faa42c2b22
child_process.exec uses a shell to parse and launch command. Since here some arguments comes from external, it's unsecured. This MR uses spawnSync instead.