broccoli-compass v0.2.4 was discovered to contain a remote code execution (RCE) vulnerability via the child_process function.