CVE-2013-7381: Potential Command Injection in libnotify

The vulnerability stems from the use of child_process.exec with unsanitized user input in the notify() function. The pre-patch code (<=1.0.3) builds a command string by joining arguments including user-controlled input (msg and options.title) with spaces, then executes via exec(). This allows shell metacharacters in user input to break out of the intended command. The fix in 1.0.4 replaces exec() with execFile(), which avoids shell interpretation by passing arguments as an array. The commit diff clearly shows the vulnerable pattern: constructing args array with quoted user input, then executing via exec(args.join(' ')).