Your server runs the code you wrote. RCE means an outsider has found a way to make it run code they wrote instead. Once that happens they can read environment variables and secrets, query the database with the app's own credentials, change files and use the machine to reach other systems.
The usual causes are passing user input into something that executes it. Examples include building a shell command from a request value, calling eval or a similar function on submitted text, rendering user input as a server-side template, and accepting file uploads that the server will later run. Known flaws in outdated packages are another route. AI tools reach for shell commands and eval as quick ways to convert a file or evaluate a formula, which is how this ends up in small apps.
Never build a command line by joining strings with user input. Use library functions instead of the shell, or pass arguments as a separate list so they cannot be read as commands. Do not evaluate user-supplied code, keep dependencies patched, and give the app the least access it needs so a break-in does less damage.
import { execFile } from "node:child_process";
execFile("convert", [inputPath, outputPath], callback);