Process.run or Process.start invoked through a shell can execute injected commands.
Pass a fixed executable with an argument list and avoid runInShell with untrusted input.