Picks up the disclosure I emailed to Rich + Yog yesterday (CWE-78 shell-injection via child_process.exec template-string in _cloneWithGit + fetchRefs). Yog encouraged contributions on the thread, so here it is — same fix the original disclosure suggested.

What this changes

• src/utils.js: exec becomes promisify(execFile) instead of promisify(child_process.exec). Calls site has to pass argv-array instead of a shell-formatted string, but no shell parses the command line, so template-string interpolation of user-influenced values becomes safe even with shell metacharacters present.
• src/index.js _cloneWithGit: switch to argv form (exec('git', ['clone', this.repo.ssh, dest])). The rm -rf <dir>/.git call gets replaced with fs.promises.rm(dir, { recursive: true, force: true }) (available since Node 14.14.0), which removes the second exec entirely.
• src/index.js fetchRefs: switch to argv form (exec('git', ['ls-remote', repo.url])).

Behavior change for normal inputs

Zero. The only difference is what happens when shell metacharacters appear in the parsed user / name capture groups (today: /bin/sh interprets them; after this PR: git rejects the path with a normal "invalid argument" error).

Reproducer for the pre-fix shape (still works on main as of HEAD)

$ mkdir /tmp/degitpoc && cd /tmp/degitpoc
$ rm -f marker_PWN
$ node /path/to/degit/src/bin.js 'github:foo/bar;:>marker_PWN' --mode=git --force test
> cloned foo/bar;:>marker_PWN#HEAD to test
$ ls -la marker_PWN
-rw-r--r--  1 user  staff  0 May 20 16:58 marker_PWN

;:>marker_PWN is parsed by /bin/sh before git clone errors out. After this PR, the same input is passed verbatim to git clone as one argv slot and fails cleanly with "repository not found" — no shell interpretation.

I tested locally that the well-formed cases (degit user/repo, degit github:user/repo#ref, ssh form) all still work after the change. Happy to add a unit test under tests/ if you want to lock the regression in.