github_osv/GHSA-g8vp-6hv4-m67c
Command Injection in entitlements
Versions of `entitlements` prior to 1.3.0 are vulnerable to Command Injection. The package does not validate input on the `entitlements` function and concatenates it to an exec call, allowing attackers to run arbitrary commands in the system.
## Recommendation
Upgrade to version 1.3.0 or later.
gitlab/npm/entitlements/GMS-2020-246
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in entitlements.