diff --git a/src/llamafactory/webui/runner.py b/src/llamafactory/webui/runner.py
index 3dd80f6b..ec549cc4 100644
--- a/src/llamafactory/webui/runner.py
+++ b/src/llamafactory/webui/runner.py
@@ -320,7 +320,12 @@ class Runner:
             if args.get("deepspeed", None) is not None:
                 env["FORCE_TORCHRUN"] = "1"
 
-            self.trainer = Popen(f"llamafactory-cli train {save_cmd(args)}", env=env, shell=True)
+            cmd = [
+                "llamafactory-cli",
+                "train", 
+                *save_cmd(args).split(),
+            ]
+            self.trainer = Popen(cmd, env=env)
             yield from self.monitor()
 
     def _form_config_dict(self, data: Dict["Component", Any]) -> Dict[str, Any]: