jenkinsci/fitnesse-plugin — comment on commit d1c93cdbd1cedb6a634af05600106c9e3d1e306a
File: src/main/java/hudson/plugins/fitnesse/FitnesseExecutor.java line 94
By instantkiwi:

Good question! Haven't tried that scenario. The plugin will pass through whatever it finds, essentially splitting it at the -X with anything inbetween passed through as the associated argument for that switch. I believe your example would lead to a call where -d ". && rm -rf /" would be prepended to the cmd line call (note the quotation marks).
Do you see this as a big issue? I would have expected anyone with the ability to setup / configure Jenkins jobs will have the ability to execute any batch files anyway, always under the Jenkins' user account that is of course...