Product
The jsii-diff tool fails to sanitize inputs provided with an 'npm:' prefix, allowing unauthenticated attackers to execute arbitrary shell commands via crafted package specifiers.