Not all developers understand what are the risks of command injections in Node.js applications and I see it more often when I triage security vulnerabilities. In this article I’m featuring a practical walk-through of an actual CVE for a Node.js module which has a command injection vulnerability.