On Windows, user-provided solution argument is interpolated into a string that gets passed to cmd.exe /c. While the solution path is quoted, shell metacharacters like "& could break out of quotes and execute arbitrary commands. For example, a solution argument of foo" & malicious & " would result in command execution. Since this is a local dev script where the user controls both execution and input, the practical risk is minimal, but the pattern is worth noting.