diff --git a/src/preflight.js b/src/preflight.js
index c45b524..702834d 100644
--- a/src/preflight.js
+++ b/src/preflight.js
@@ -73,9 +73,15 @@ function runCodexVersionProbe(codexBin) {
     candidates = [codexBin];
   }
 
+  const hasShellMetacharacters = value => /[;&|`$()<>^"'\n\r]/.test(value);
+
   for (const candidate of candidates) {
     const extension = path.extname(candidate).toLowerCase();
-    const result = process.platform === 'win32' && (extension === '.cmd' || extension === '.bat')
+    const useShell = process.platform === 'win32' && (extension === '.cmd' || extension === '.bat');
+    if (useShell && hasShellMetacharacters(candidate)) {
+      continue;
+    }
+    const result = useShell
       ? spawnSync(candidate, ['--version'], {
         shell: true,
         encoding: 'utf8',