CVE-2018-3785: Command Injection in git-dummy-commit

The vulnerability stems from improper neutralization of parameters used in OS commands (CWE-78). Given the package's purpose of creating git commits, the core function that builds and executes git commands would handle user-provided commit messages. Without proper input sanitization or use of safe execution methods (like execFile with separate arguments), passing unsanitized input to child_process.exec would make command injection possible. The description explicitly mentions 'unescaped parameter' as the root cause, strongly indicating insecure command construction in the commit creation function.