diff --git a/core/modules/simpletest/simpletest.module b/core/modules/simpletest/simpletest.module
index 0e0ea2afd4006d6c66b5906ccdbeb864284c27b9..0f360fe4a22b5a114c0d902c66b213fe16d8f32f 100644
--- a/core/modules/simpletest/simpletest.module
+++ b/core/modules/simpletest/simpletest.module
@@ -389,12 +389,12 @@ function simpletest_phpunit_command() {
 
   // The file in Composer's bin dir is a *nix link, which does not work when
   // extracted from a tarball and generally not on Windows.
-  $command = $vendor_dir . '/phpunit/phpunit/phpunit';
+  $command = escapeshellarg($vendor_dir . '/phpunit/phpunit/phpunit');
   if (substr(PHP_OS, 0, 3) == 'WIN') {
     // On Windows it is necessary to run the script using the PHP executable.
     $php_executable_finder = new PhpExecutableFinder();
     $php = $php_executable_finder->find();
-    $command = $php . ' -f ' . escapeshellarg($command) . ' --';
+    $command = $php . ' -f ' . $command . ' --';
   }
   return $command;
 }