Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
This affects the package json before 10.0.0. It is possible to inject arbritary commands using the parseLookup function.
Advisories for Maven/Org.webjars.npm/Json package
2021