diff --git a/cli/release_publish.php b/cli/release_publish.php
index 1529977..7ab16de 100644
--- a/cli/release_publish.php
+++ b/cli/release_publish.php
@@ -66,7 +66,7 @@ if (empty($stability) || empty($token)) {
 }
 
 $cli = __DIR__;
-$php = PHP_BINARY;
+$php = escapeshellarg(PHP_BINARY);
 $giteaUrl = rtrim($giteaUrl, '/');
 
 // Auto-detect org/repo from git remote if not set
diff --git a/cli/version_auto_bump.php b/cli/version_auto_bump.php
index e8ba89c..5378608 100644
--- a/cli/version_auto_bump.php
+++ b/cli/version_auto_bump.php
@@ -63,7 +63,7 @@ if (array_key_exists($branch, $stabilityMap)) {
 }
 
 $cli = __DIR__;
-$php = PHP_BINARY;
+$php = escapeshellarg(PHP_BINARY);
 
 // Auto-detect watch path from manifest.xml if not provided
 if (empty($watchPath)) {