@@ -64,6 +64,7 @@
     "Nitin",
     "nwjs",
     "Oikawa",
+    "PATHEXT",
     "pathinfo",
     "plopfile",
     "pnpm",
 
@@ -647,20 +647,65 @@ class WebpackCLI {
       return spawnSync(command, args, options);
     }
 
-    // Package managers are `.cmd` files on Windows, which only a shell runs, and the shell doesn't
-    // escape arguments
+    // Find the file of the command like `which`, on Windows the current directory goes first
+    const extensions = (process.env.PATHEXT || ".EXE;.CMD;.BAT;.COM").split(";");
+
+    if (command.includes(".") && extensions[0] !== "") {
+      extensions.unshift("");
+    }
+
+    const directories = /[/\\]/.test(command)
+      ? [""]
+      : [process.cwd(), ...(process.env.PATH || "").split(";")];
+    let file: string | undefined;
+
+    search: for (const directory of directories) {
+      for (const extension of extensions) {
+        const candidate = path.resolve(
+          path.join(directory.replace(/^"(.*)"$/, "$1"), command) + extension,
+        );
+
+        try {
+          if (
+            fs.statSync(candidate).isFile() &&
+            extensions.some(
+              (extension) =>
+                extension !== "" && candidate.toLowerCase().endsWith(extension.toLowerCase()),
+            )
+          ) {
+            file = candidate;
+
+            break search;
+          }
+        } catch {
+          // Not found
+        }
+      }
+    }
+
+    // Executables run directly
+    if (file && /\.(?:com|exe)$/i.test(file)) {
+      return spawnSync(command, args, options);
+    }
+
+    // Other files, e.g. `npm.cmd`, only run in a shell, which doesn't escape arguments, and the
+    // `.cmd` shims of packages pass them to another shell, so they are escaped twice
+    const isShim = Boolean(file && /node_modules[\\/].bin[\\/][^\\/]+\.cmd$/i.test(file));
+    const metaChars = /([()\][%!^"`<>&|;, *?])/g;
     const escapedArgs = args.map((arg) => {
       const quoted = `"${arg
         // Double the backslashes before a quote and escape the quote
         .replaceAll(/(?=(\\+?)?)\1"/g, '$1$1\\"')
         // Double the backslashes at the end, they precede the closing quote
-        .replace(/(?=(\\+?)?)\1$/, "$1$1")}"`;
+        .replace(/(?=(\\+?)?)\1$/, "$1$1")}"`.replaceAll(metaChars, "^$1");
 
-      // Escape the characters `cmd.exe` treats specially
-      return quoted.replaceAll(/([()\][%!^"`<>&|;, *?])/g, "^$1");
+      return isShim ? quoted.replaceAll(metaChars, "^$1") : quoted;
     });
 
-    return spawnSync([command, ...escapedArgs].join(" "), { ...options, shell: true });
+    return spawnSync(
+      [path.normalize(command).replaceAll(metaChars, "^$1"), ...escapedArgs].join(" "),
+      { ...options, shell: true },
+    );
   }
 
   async getDefaultPackageManager(): Promise<PackageManager | undefined> {
 
@@ -1,5 +1,8 @@
 "use strict";
 
+const fs = require("node:fs");
+const os = require("node:os");
+const path = require("node:path");
 const { stripVTControlCharacters } = require("node:util");
 const CLI = require("../../packages/webpack-cli/lib/webpack-cli").default;
 
@@ -99,23 +102,71 @@ describe("installPackage", () => {
     expectInstallCommand("pnpm", ["install", "-D", "test-package"]);
   });
 
-  it("should escape the arguments for the shell on Windows", async () => {
-    readlineQuestionMock.mockImplementation((_questionTest, cb) => cb("y"));
-    getDefaultPackageManagerSpy.mockReturnValue("npm");
+  describe("on Windows", () => {
+    let directory;
+    let platform;
+    let env;
+
+    beforeEach(() => {
+      directory = fs.mkdtempSync(path.join(os.tmpdir(), "webpack-cli-install-package-"));
+      platform = Object.getOwnPropertyDescriptor(process, "platform");
+      env = { PATH: process.env.PATH, PATHEXT: process.env.PATHEXT };
+
+      Object.defineProperty(process, "platform", { value: "win32" });
+      process.env.PATH = directory;
+      process.env.PATHEXT = ".exe;.cmd";
+      readlineQuestionMock.mockImplementation((_questionTest, cb) => cb("y"));
+      getDefaultPackageManagerSpy.mockReturnValue("npm");
+    });
 
-    const platform = Object.getOwnPropertyDescriptor(process, "platform");
+    afterEach(() => {
+      Object.defineProperty(process, "platform", platform);
 
-    Object.defineProperty(process, "platform", { value: "win32" });
+      for (const [name, value] of Object.entries(env)) {
+        if (typeof value === "undefined") {
+          delete process.env[name];
+        } else {
+          process.env[name] = value;
+        }
+      }
+
+      fs.rmSync(directory, { recursive: true, force: true });
+    });
+
+    it("should escape the arguments for the shell", async () => {
+      fs.writeFileSync(path.join(directory, "npm.cmd"), "");
 
-    try {
       await cli.installPackage('a"b&c');
-    } finally {
-      Object.defineProperty(process, "platform", platform);
-    }
 
-    expect(spawnMock).toHaveBeenCalledWith('npm ^"install^" ^"-D^" ^"a\\^"b^&c^"', {
-      stdio: "inherit",
-      shell: true,
+      expect(spawnMock).toHaveBeenCalledWith('npm ^"install^" ^"-D^" ^"a\\^"b^&c^"', {
+        stdio: "inherit",
+        shell: true,
+      });
+    });
+
+    it("should escape the arguments twice for the shims of packages", async () => {
+      const bin = path.join(directory, "node_modules", ".bin");
+
+      fs.mkdirSync(bin, { recursive: true });
+      fs.writeFileSync(path.join(bin, "npm.cmd"), "");
+      process.env.PATH = bin;
+
+      await cli.installPackage('a"b&c');
+
+      expect(spawnMock).toHaveBeenCalledWith(
+        'npm ^^^"install^^^" ^^^"-D^^^" ^^^"a\\^^^"b^^^&c^^^"',
+        { stdio: "inherit", shell: true },
+      );
+    });
+
+    it("should run executables without a shell", async () => {
+      fs.writeFileSync(path.join(directory, "npm.exe"), "");
+
+      await cli.installPackage("test-package");
+
+      expect(spawnMock).toHaveBeenCalledWith("npm", ["install", "-D", "test-package"], {
+        stdio: "inherit",
+      });
     });
   });