Command execution via unsanitized run input

Command injection in p4 before 0.0.7 allows local users to execute arbitrary commands through the run() function. The vulnerable runCommand implementation concatenates command and arguments into a shell string passed to child_process.exec, allowing metacharacters such as '&' to start attacker-selected commands. Exploitation requires local code to invoke run() with attacker-controlled input and can compromise confidentiality, integrity, and availability.