diff --git a/core/modules/simpletest/simpletest.module b/core/modules/simpletest/simpletest.module
index 4ace6e4594..c765995043 100644
--- a/core/modules/simpletest/simpletest.module
+++ b/core/modules/simpletest/simpletest.module
@@ -389,12 +389,12 @@ function simpletest_phpunit_command() {
 
   // The file in Composer's bin dir is a *nix link, which does not work when
   // extracted from a tarball and generally not on Windows.
-  $command = $vendor_dir . '/phpunit/phpunit/phpunit';
+  $command = escapeshellarg($vendor_dir . '/phpunit/phpunit/phpunit');
   if (substr(PHP_OS, 0, 3) == 'WIN') {
     // On Windows it is necessary to run the script using the PHP executable.
     $php_executable_finder = new PhpExecutableFinder();
     $php = $php_executable_finder->find();
-    $command = $php . ' -f ' . escapeshellarg($command) . ' --';
+    $command = $php . ' -f ' . $command . ' --';
   }
   return $command;
 }