CVE-2021-23376: Command Injection in ffmpegdotjs

The vulnerability documentation explicitly identifies trimvideo as the entry point, and the code shows direct interpolation of user-controlled parameters (start, duration, output) into an exec() call without sanitization. The provided PoC demonstrates successful exploitation through the output parameter. While other functions in index.js also use exec(), only trimvideo is explicitly confirmed vulnerable through advisory details and reproduction evidence.