`macaddress` concatenates unsanitized input into exec() command

> NOTE! Thanks for submitting a report! Please replace *all* the [square] sections below with the pertinent details. Remember, the more detail you provide, the easier it is for us to triage and respond quickly, so be sure to take your time filling out the report!

lib/linux.js:4:    exec("cat /sys/class/net/" + iface + "/address", function (err, out) {
lib/macosx.js:4:    exec("networksetup -getmacaddress " + iface, function (err, out) {
lib/unix.js:4:    exec("ifconfig " + iface, function (err, out) {