CVE-2023-49210: openssl npm package vulnerable to command execution

The vulnerability stems from the openssl function in index.js which unsafely concatenates user-provided 'verb' parameter into an exec command. The code sample shows direct interpolation of opts.verb into the command string without validation or sanitization. This allows attackers to inject commands via shell operators (e.g., '| touch exploited.txt'). The advisory explicitly identifies the verb field as the injection vector, and the proof-of-concept demonstrates successful exploitation through this parameter. The use of child_process.exec with unvalidated input is a well-known command injection pattern (CWE-77).