Executing shell commands with unsanitized user input allows command injection.
Avoid passing user input to shell commands. Use execFile with an argument array instead of exec.