CVE-2021-33360: stoqey/gnuplot is vulnerable to command injection

The vulnerability exists in how user-controlled 'filePath' is directly interpolated into shell commands via child_process.exec. The plotCallack function contains two critical insecure patterns: 1) 'exec(touch ${filePath})' and 2) 'exec(gnuplot > ${filePath})' (or similar PDF variant). These implementations allow attackers to inject arbitrary commands through shell metacharacters in the filename parameter. The lack of input validation/sanitization and unsafe command construction directly maps to CWE-77 command injection. The GitHub advisory specifically calls out plotCallack and filePath as vulnerable components.