That sounds like an RCE waiting to happen.

The canonical way to solve this would be to pass the components of that command line through a function that escapes or quotes anything that needs to be escaped. In Ruby and when using bash for example we have [0].

Does Windows have something similar?

[0]: https://ruby-doc.org/stdlib-2.5.1/libdoc/shellwords/rdoc/She...