Inquiry Regarding Deno Security Model and Command Injection Vulnerability

import { Application, Router } from "https://deno.land/x/oak/mod.ts";
import { exec } from "https://deno.land/x/exec/mod.ts";


const app = new Application();
const router = new Router();

// Serve static files from the current directory

const cmd = await Deno.run({
    cmd: ["sh", "-c", `ping -c 4 ${ip}`],
    stdout: "piped",
    stderr: "piped",
});

const [status, stdout, stderr] = await Promise.all([
    cmd.status(),
    cmd.output(),
    cmd.stderrOutput(),
]);

if (status.success) {
    const result = new TextDecoder().decode(stdout);
    //send result to client
    context.response.body = result;
} else {
    const error = new TextDecoder().decode(stderr);
    console.log(error);
}
    }
);

deno run --allow-net --allow-env --allow-run   indexSecure.js