CVE-2022-25171: p4 vulnerable to Command Injection due to improper input sanitization

The vulnerability stems from the pre-patch implementation of runCommand in p4.js, which used child_process.exec() with string concatenation to execute p4 commands. This approach allowed command injection through specially crafted arguments, as demonstrated in the Snyk PoC. The patch replaced exec() with spawn() and array-based argument handling, confirming the vulnerability existed in the original runCommand implementation. The function is explicitly referenced in CVE descriptions and security advisories as the injection vector.