Suspected Vulnerability & Bug Bounty - External Code Execution - huntr.dev

This issue has been generated on-behalf of Mik317 (https://huntr.dev/app/users/Mik317)

# Overview

[cordova-serve](https://github.com/apache/cordova-serve) provides a JavaScript API to serve up a Cordova application in the browser.

The issue occurs because a `user input` is formatted inside a `command` that will be executed without any check.

# Bug Bounty

We have opened up a bounty for this issue on our bug bounty platform. Want to solve this vulnerability and get rewarded 💰? Go to https://huntr.dev/

We will submit a pull request directly to your repository with the fix as soon as possible. Want to learn more? Go to https://github.com/418sec/huntr 📚

_Automatically generated by @huntr-helper..._

The report identifies cordova-serve's JavaScript API and says user input is formatted into an unchecked command. Start by locating the API entry point that builds and executes that command, then reproduce the behavior safely. Done means untrusted input cannot trigger external code execution and the relevant regression checks pass.

Written by the indexing model from the issue text.