Versions of the package window-control before 1.4.5 are vulnerable to Command Injection via the sendKeys function, due to improper input sanitization.
CWE-78, NVD-CWE-Other, CWE-94