Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
async function writeUpdate(newVersion, shouldCommit) {
  const helper = fs.readFileSync('./lib/chromedriver.js', 'utf8');
  const versionExport = 'exports.version';
  const regex = new RegExp(`^.*${versionExport}.*$`, 'gm');
  const updated = helper.replace(regex, `${versionExport} = '${newVersion}';`);
  const currentMajor = semver.major(currentVersionInPackageJson);
  const newMajor = semver.major(semver.coerce(newVersion));
  const version = currentMajor !== newMajor ? `${newMajor}.0.0` : semver.inc(currentVersionInPackageJson, 'patch');
  execSync(`npm version ${version} --git-tag-version=false`);
  fs.writeFileSync('./lib/chromedriver.js', updated, 'utf8');
  if (!shouldCommit) return;
  execSync('git add :/');
  execSync(`git commit -m "Bump version to ${version}"`);
  execSync(`git tag -s ${version} -m ${version}`);
}