Me too... with figuring out security with exec at least. Yes is the answer, and this is noted in the nodejs documentation for exec. The difficulty seems to be

Me too... with figuring out security with exec at least. Yes is the answer, and this is noted in the nodejs documentation for exec. The difficulty seems to be that there is no generic pattern for making it safe with exec, it's contextual. Preventing exploits requires you to consider which shell, which command and which part of that combination is being exposed to your user input for you to know exactly what must be sanitised from your user input if you want anything more than alphanumerics. I suggested one simpler safe pattern lower down in this thread which is encapsulating user based parameters in single quotes (which requires only sanitising against single quotes). Although this is safe, others have noted valid arguments against this too. It seems like it's just best avoided unless absolutely necessary (most often it's not).