diff --git a/packages/cli/src/utils/misc.js b/packages/cli/src/utils/misc.js
index 951e98441..166d4d846 100644
--- a/packages/cli/src/utils/misc.js
+++ b/packages/cli/src/utils/misc.js
@@ -25,16 +25,19 @@ const isWindows = () => {
 
 // Run a bash command with a promise.
 const runCommand = (command, args, options) => {
-  if (isWindows()) {
-    command += '.cmd';
-  }
-
   if (_.get(global, ['argOpts', 'debug'])) {
     debug.enabled = true;
   }
 
   options = options || {};
 
+  if (isWindows()) {
+    command += '.cmd';
+
+    // See CVE-2024-27980
+    options.shell = true;
+  }
+
   debug('\n');
   debug(
     `Running ${colors.bold(