RCE in /yt-stream route

[gronke]

The url query param might contain shell escape or pipeline characters, such as | or ;, resulting in remote code execution:

PiCAST/picast.js

Line 12 in ed6a7ba

exec("livestreamer --player=mplayer https://www.youtube.com/watch?v=" + req.params.url + " best");