diff --git a/src/Model/Build/GitBuild.php b/src/Model/Build/GitBuild.php
index 77c388ab..65528935 100644
--- a/src/Model/Build/GitBuild.php
+++ b/src/Model/Build/GitBuild.php
@@ -102,8 +102,8 @@ protected function cloneByHttp(Builder $builder, $cloneTo)
             $cmd .= ' --depth ' . \intval($buildSettings['clone_depth']) . ' ';
         }
 
-        $cmd .= ' -b "%s" "%s" "%s"';
-        $success = $builder->executeCommand($cmd, $this->getBranch(), $this->getCloneUrl(), $cloneTo);
+        $cmd .= ' -b %s "%s" "%s"';
+        $success = $builder->executeCommand($cmd, \escapeshellarg($this->getBranch()), $this->getCloneUrl(), $cloneTo);
 
         if ($success) {
             $success = $this->postCloneSetup($builder, $cloneTo);
@@ -132,10 +132,10 @@ protected function cloneBySsh(Builder $builder, $cloneTo)
             $cmd .= ' --depth ' . \intval($buildSettings['clone_depth']) . ' ';
         }
 
-        $cmd .= ' -b "%s" "%s" "%s"';
+        $cmd .= ' -b %s "%s" "%s"';
         $cmd = 'export GIT_SSH="' . $gitSshWrapper . '" && ' . $cmd;
 
-        $success = $builder->executeCommand($cmd, $this->getBranch(), $this->getCloneUrl(), $cloneTo);
+        $success = $builder->executeCommand($cmd, \escapeshellarg($this->getBranch()), $this->getCloneUrl(), $cloneTo);
 
         if ($success) {
             $extra = [
@@ -167,7 +167,7 @@ protected function postCloneSetup(Builder $builder, $cloneTo, array $extra = nul
 
         if (empty($this->getEnvironmentId()) && !empty($commitId)) {
             $cmd     = $chdir . ' && git checkout %s --quiet';
-            $success = $builder->executeCommand($cmd, $cloneTo, $commitId);
+            $success = $builder->executeCommand($cmd, $cloneTo, \escapeshellarg($commitId));
         }
 
         // Always update the commit hash with the actual HEAD hash
@@ -176,11 +176,11 @@ protected function postCloneSetup(Builder $builder, $cloneTo, array $extra = nul
 
             $this->setCommitId($commitId);
 
-            if ($builder->executeCommand($chdir . ' && git log -1 --pretty=format:%%s %s', $cloneTo, $commitId)) {
+            if ($builder->executeCommand($chdir . ' && git log -1 --pretty=format:%%s %s', $cloneTo, \escapeshellarg($commitId))) {
                 $this->setCommitMessage(\trim($builder->getLastOutput()));
             }
 
-            if ($builder->executeCommand($chdir . ' && git log -1 --pretty=format:%%ae %s', $cloneTo, $commitId)) {
+            if ($builder->executeCommand($chdir . ' && git log -1 --pretty=format:%%ae %s', $cloneTo, \escapeshellarg($commitId))) {
                 $this->setCommitterEmail(\trim($builder->getLastOutput()));
             }
         }
diff --git a/src/Model/Build/HgBuild.php b/src/Model/Build/HgBuild.php
index 6ac11e84..046dc824 100644
--- a/src/Model/Build/HgBuild.php
+++ b/src/Model/Build/HgBuild.php
@@ -78,7 +78,7 @@ public function createWorkingCopy(Builder $builder, $buildPath)
      */
     protected function cloneByHttp(Builder $builder, $cloneTo)
     {
-        return $builder->executeCommand('hg clone %s "%s" -r %s', $this->getCloneUrl(), $cloneTo, $this->getBranch());
+        return $builder->executeCommand('hg clone %s "%s" -r %s', $this->getCloneUrl(), $cloneTo, \escapeshellarg($this->getBranch()));
     }
 
     /**
@@ -94,7 +94,7 @@ protected function cloneBySsh(Builder $builder, $cloneTo)
 
         // Do the hg clone:
         $cmd     = 'hg clone --ssh "ssh -i ' . $keyFile . '" %s "%s" -r %s';
-        $success = $builder->executeCommand($cmd, $this->getCloneUrl(), $cloneTo, $this->getBranch());
+        $success = $builder->executeCommand($cmd, $this->getCloneUrl(), $cloneTo, \escapeshellarg($this->getBranch()));
 
         if ($success) {
             $success = $this->postCloneSetup($builder, $cloneTo);
@@ -121,7 +121,7 @@ protected function postCloneSetup(Builder $builder, $cloneTo, array $extra = nul
         // Allow switching to a specific branch:
         if (!empty($commitId)) {
             $cmd     = 'cd "%s" && hg checkout %s';
-            $success = $builder->executeCommand($cmd, $cloneTo, $this->getBranch());
+            $success = $builder->executeCommand($cmd, $cloneTo, \escapeshellarg($this->getBranch()));
         }
 
         return $success;
diff --git a/src/Model/Build/SvnBuild.php b/src/Model/Build/SvnBuild.php
index 97869dcb..a1ab3498 100644
--- a/src/Model/Build/SvnBuild.php
+++ b/src/Model/Build/SvnBuild.php
@@ -111,7 +111,7 @@ protected function cloneByHttp(Builder $builder, $cloneTo)
 
         if (!empty($this->getCommitId())) {
             $cmd .= ' -r %s %s "%s"';
-            $success = $builder->executeCommand($cmd, $this->getCommitId(), $this->getCloneUrl(), $cloneTo);
+            $success = $builder->executeCommand($cmd, \escapeshellarg($this->getCommitId()), $this->getCloneUrl(), $cloneTo);
         } else {
             $cmd .= ' %s "%s"';
             $success = $builder->executeCommand($cmd, $this->getCloneUrl(), $cloneTo);