Javascript Command_Injection Vulnerability

Question

I have below code in my js file, Checkmarx flagged a command injection vulnerability at execSync('scripts/beautify_yaml.sh '+ yamlPath).toString();

function beautifyYaml(yamlPath) {
    return execSync('scripts/beautify_yaml.sh '+ yamlPath).toString();
}

I added a validation check before execSync function but checkmarx still flags the same command injection issue at execSync function. Is there another way to resolve command injection issue at line execSync('scripts/beautify_yaml.sh '+ yamlPath).toString();

Validation check:

function beautifyYaml(yamlPath) {
    const reg = new RegExp("^[a-zA-Z0-9\-_.\/]+$");
    if (!reg.test(yamlPath)) {
        throw new Error('Invalid YAML file path.');
    }
    return execSync('scripts/beautify_yaml.sh '+ yamlPath).toString();
}