Fix OS command injection in convertToSingleHost.js manifest update

[Zheng (zhngx1)]

Summary

Fixes an OS command injection vulnerability (CWE-78) in convertToSingleHost.js where the projectName and appId command-line arguments were interpolated into a shell command string and executed via childProcess.exec.

Problem

The manifest-update step built a command string from untrusted process.argv values and ran it through a shell:

const cmdLine = `npx office-addin-manifest modify ${manifestPath} -g ${appId} -d "${projectName}"`;
childProcess.exec(cmdLine, { env: execEnv }, ...);

Because exec runs its argument through a shell (cmd.exe or /bin/sh), shell metacharacters (;, &&, `, $(), |) in appId or projectName were interpreted. appId was also completely unquoted. If an integrator forwarded untrusted input into these arguments, this allowed arbitrary command execution.

Fix

• Replaced childProcess.exec (shell) with childProcess.execFile(..., { shell: false }) and an argument array, so appId and projectName are passed as literal arguments and can no longer inject commands.
• Invoke the office-addin-manifest CLI directly with process.execPath (the running Node binary) via require.resolve("office-addin-manifest/cli.js"), instead of the npx/npx.cmd shim. This also fixes spawn EINVAL on Node 24+, which refuses to run .cmd shims through execFile without a shell.

[Darren Miller (millerds)]

Make sure to fix the other template repos and run 'npm audit fix' to pickup any new vulnerability fixes.