Potential command injection vulnerability in gommitjs

[xiaofen9]

Hi,

We would like to report a potential security vulnerability.
The bug is introduced because the package-exported method gommit() fails to sanitize its parameter and lets it flow into a sensitive command execution API.

Here is the proof of concept.

var gommitjs = require("gommitjs")
gommitjs.gommit([";touch rce"]) // a file named rce will be created

Please consider fixing it. thanks!