ProcessBuilder constructed with an interpolated or concatenated variable can execute attacker-controlled commands.
Pass a static list of arguments and never build the command line from untrusted data.