npm audit run on my project and got me this
npm audit
High Command Injection Dependency of @angular-devkit/build-angular [dev]
Check the GitHub repo to see if a fix is being worked on. I found this issue: https://github.com/angular/angular-cli/issues/16629 and a pull request (https://github.com/angular/angular-cli/pull/15894) which removes the dependency.