Please report vulnerabilities privately through GitHub's security advisory feature. Include reproduction steps, affected versions, and impact where possible. Do not open a public issue for an unpatched vulnerability.

The maintained release line is version 1.x on supported Node.js versions. Git is invoked with argument arrays and never through a shell.