diff --git a/build.py b/build.py
index ce9a09ef6..049343563 100755
--- a/build.py
+++ b/build.py
@@ -1,6 +1,8 @@
 #!/usr/bin/env python3
 
 import os
+import shlex
+import subprocess
 import pathlib
 import platform
 import zipfile
@@ -39,7 +41,8 @@ def get_deb_extra_depends() -> str:
     return ""
 
 def system2(cmd):
-    exit_code = os.system(cmd)
+    args = cmd if isinstance(cmd, list) else shlex.split(cmd)
+    exit_code = subprocess.call(args)
     if exit_code != 0:
         sys.stderr.write(f"Error occurred when executing: `{cmd}`. Exiting.\n")
         sys.exit(-1)
diff --git a/libs/portable/generate.py b/libs/portable/generate.py
index 0116c2cd5..7b91bb33f 100755
--- a/libs/portable/generate.py
+++ b/libs/portable/generate.py
@@ -2,6 +2,8 @@
 
 import os
 import optparse
+import re
+import subprocess
 from hashlib import md5
 import brotli
 import datetime
@@ -64,12 +66,21 @@ def write_app_metadata(output_folder: str):
         f.write(f"timestamp = {int(datetime.datetime.now().timestamp() * 1000)}\n")
     print(f"App metadata has been written to {output_path}")
 
+# Allowlist pattern for valid cargo target triples (e.g. x86_64-unknown-linux-gnu)
+_VALID_TARGET_RE = re.compile(r'^[A-Za-z0-9_\-]+$')
+
+
 def build_portable(output_folder: str, target: str):
     os.chdir(output_folder)
     if target:
-        os.system("cargo build --release --target " + target)
+        if not _VALID_TARGET_RE.match(target):
+            raise ValueError(
+                f"Invalid --target value {target!r}. "
+                "Only alphanumeric characters, hyphens, and underscores are allowed."
+            )
+        subprocess.run(["cargo", "build", "--release", "--target", target], check=True)
     else:
-        os.system("cargo build --release")
+        subprocess.run(["cargo", "build", "--release"], check=True)
 
 # Linux: python3 generate.py -f ../rustdesk-portable-packer/test -o . -e ./test/main.py
 # Windows: python3 .\generate.py -f ..\rustdesk\flutter\build\windows\runner\Debug\ -o . -e ..\rustdesk\flutter\build\windows\runner\Debug\rustdesk.exe