CPE
The easy-pdf-merge package (versions 0.1.0 through 0.2.6) contains an OS command injection vulnerability via unsanitized input to child_process.exec(), allowing arbitrary code execution.