NodeJS spawn does not escape bad strings

Question

I want to download a url in a remote host using ssh, i was using exec(), it was working:

const cmd = `mkdir -p /home/username/test; wget --no-check-certificat