Node’s child_process.exec() [0] passes the first argument straight into a shell, so you can use whatever shell features you want. The functionality you’re talki

Node’s child_process.exec() [0] passes the first argument straight into a shell, so you can use whatever shell features you want. The functionality you’re talking about is provided by child_process.spawn() [1] (as long as the shell option isn’t specified). The exec() documentation actually provides a warning: > Never pass unsanitized user input to this function. Any input containing shell metacharacters may be used to trigger arbitrary command execution. Likewise, spawn() says this: > If the shell option is enabled, do not pass unsanitized user input to this function. Any input containing shell metacharacters may be used to trigger arbitrary command execution. I do think the naming could be better - why isn’t exec() called shell()? [0]: https://nodejs.org/api/child_process.html#child_process_child_process_exec_command_options_callback https://nodejs.org/api/child_process.html#child_process_chil... [1]: https://nodejs.org/api/child_process.html#child_process_child_process_spawn_command_args_options https://nodejs.org/api/child_process.html#child_process_chil...