This is vulnerable to a single quote in the command or extras causing failure.  (Shell injection style, but likely only a test failure, not an actual attack, given the context of use.)