react-dev-utils is using shell-quote 1.7.2 which has a vulnerability that has been fixed in 1.7.3