ProcessBuilder constructed with concatenated arguments permits command injection.
Use a fixed argument list and validate or allowlist any user-controlled arguments.