CVE-2020-28438

This affects all versions of package deferred-exec. The injection point is located in line 42 in lib/deferred-exec.js