OS Command Injection in ios-utils package via `getFieldFromPlist` Function

### Summary
The `ios-utils` package for Node.js, up to and including version 1.0.9, contains an **OS command injection vulnerability** (CWE-78) in the `getFieldFromPlist` function. This flaw allows attackers to execute arbitrary operating system commands due to insufficient input sanitization, potentially leading to unauthorized system access or data compromise. The vulnerability remains unpatched in the latest available version.

### Details
The vulnerability exists in the `getFieldFromPlist` function, which improperly validates user-provided input before using it in command execution. By manipulating the `plistPath` or `fieldName` parameters, an attacker can inject malicious commands into the operating system shell. This issue affects all versions of `ios-utils` up to and including 1.0.9.

The package is designed to interact with iOS property list (`.plist`) files, but the lack of strict input validation in the affected function allows command injection when untrusted data is passed to the `getFieldFromPlist` method.

### Impact
- **Vulnerability Type**: OS Command Injection (CWE-78)
- **Affected Users**: Applications or systems using `ios-utils@<=1.0.9` that process untrusted input via the `getFieldFromPlist` function.
- **Potential Impact**: Attackers can execute arbitrary OS commands, leading to system compromise, data theft, or service disruption. No authentication is required to exploit this vulnerability.

For further details, refer to the [package repository](https://github.com/macacajs/ios-utils).#

Start by inspecting the getFieldFromPlist entry point in the ios-utils package, focusing on how plistPath and fieldName reach command execution. Confirm the affected versions and define completion as ensuring untrusted values cannot execute arbitrary operating-system commands.

Written by the indexing model from the issue text.