This isn't a case of JS gun gone wrong. Someone's passing cat inside exec with an arbitrary path instead of using native open&read and path.join. That's a thing possible in almost every modern language.

Stop the nonsense. Seriously. Stop.