Cpe:2.3:a:offactory:compress-Fonts:*:*:*:*:*:node.js:*:*

The @offactory/compress-fonts package before version 1.1.1 is vulnerable to OS command injection via unquoted font file path interpolation in child_process.execSync.