Arbitrary OS command injection vulnerabilities are more likely when a shell is spawned rather than a new process, indeed shell meta-chars can be used (when parameters are user-controlled for instance) to inject OS commands.
There is a risk if you answered yes to any of this questions.
Use functions that don't spawn a shell.
const cp = require('child_process');
// A shell will be spawn in these following cases:
cp.exec(str); // Sensitive
cp.execSync(str); // Sensitive
cp.spawn(str, { shell: true }); // Sensitive
cp.spawnSync(str, { shell: true }); // Sensitive
cp.execFile(str, { shell: true }); // Sensitive
cp.execFileSync(str, { shell: true }); // Sensitive
const cp = require('child_process');
cp.execFile("/usr/bin/file.exe", { shell: false }); // Compliant (note that by default with execFile method, shell property is set to false)