The function below prepares a shell command by concatenating a script path with a user-supplied argument — the exact shape you'd hand to child_process.exec().
The bug: an attacker can pass "&& rm -rf /" as the argument. Once concatenated into a single shell string, the shell interprets && as a command separator and runs the attacker's payload.
Your task: fix solve(scriptPath, userArg) so it returns a command descriptor instead of a shell string:
// Expected return shape — safe for child_process.execFile() / spawn()
{ cmd: scriptPath, args: ['--option', userArg] }userArg must only ever appear as an array element, never concatenated into a string — that's what keeps shell metacharacters inert.
Sample tests