From e2798ffced484b74f15275a2b86e21b1d8829be3 Mon Sep 17 00:00:00 2001
From: anupamme <mediratta@gmail.com>
Date: Thu, 17 Sep 2026 09:28:38 +0000
Subject: [PATCH] fix:
 javascript.lang.security.detect-child-process.detect-child-process security
 vulnerability

Automated security fix generated by OrbisAI Security
---
 scripts/installCK5windows.js | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/scripts/installCK5windows.js b/scripts/installCK5windows.js
index cc8f2cd84..710d0122a 100644
--- a/scripts/installCK5windows.js
+++ b/scripts/installCK5windows.js
@@ -1,4 +1,4 @@
-const { exec } = require("child_process");
+const { exec, execFile } = require("child_process");
 const { emitWarning } = require("process");
 
 const pack = () =>
@@ -15,8 +15,10 @@ const pack = () =>
 
 const installMathtype = (path) =>
   new Promise((resolve, reject) => {
-    exec(
-      `cd demos/html/ckeditor5 && npm install ../../../packages/mathtype-ckeditor5/${path}`,
+    execFile(
+      "npm",
+      ["install", `../../../packages/mathtype-ckeditor5/${path.trim()}`],
+      { cwd: "demos/html/ckeditor5", shell: false },
       (err, stdout, stderr) => {
         if (err) {
           reject(err);