That's assuming user input is used to build the command string. If the command is hardcoded, or if interpolated data is well validated (matches /^\w+\z/, for example), there's no problem.