diff --git a/composer/Composer.php b/composer/Composer.php
index 09f4fdf0ec45..aef45973f361 100644
--- a/composer/Composer.php
+++ b/composer/Composer.php
@@ -83,7 +83,7 @@ protected static function setTemplateProjectStability(string $root, string $vers
     $templateProjectPaths = static::composerSubprojectPaths($root, 'Template');
     foreach ($templateProjectPaths as $path) {
       $dir = dirname($path);
-      exec("composer --working-dir=$dir config minimum-stability $stability", $output, $status);
+      exec("composer --working-dir=" . escapeshellarg($dir) . " config minimum-stability " . escapeshellarg($stability), $output, $status);
       if ($status) {
         throw new \Exception('Could not set minimum-stability for template project ' . basename($dir));
       }