Interpolating variables inside backticks or %x() executes attacker-controlled shell commands.
Use Open3.capture2 with an argument array instead of backticks or %x with interpolation.