[BUG]: Vulnerability reported by Veracode Static Scan

**Describe the bug**
Hi all.
We got the following vulnerability issue when we ran Veracode Static Scan.
Could you take a look and share your thoughts about it?
Thanks in advance!

**To Reproduce**
Run Veracode Static Scan against microsoft-spark jar files.

Found in v2.0.0.
microsoft-spark-2-4_2.11-2.0.0.jar - org/apache/spark/deploy/dotnet/DotnetRunner.scala:136
microsoft-spark-3-0_2.12-2.0.0.jar - org/apache/spark/deploy/dotnet/DotnetRunner.scala:135
microsoft-spark-3-1_2.12-2.0.0.jar - org/apache/spark/deploy/dotnet/DotnetRunner.scala:135

Veracode Issue CWE ID 78
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
https://cwe.mitre.org/data/definitions/78.html

> Attack Vector: java.lang.ProcessBuilder.start
> Number of Modules Affected: 1
>
> Description: This call to java.lang.ProcessBuilder.start() contains a command injection flaw. The argument to the function is constructed using untrusted input. If an attacker is allowed to specify all or part of the command, it may be possible to execute commands on the server with the privileges of the executing process. The level of exposure depends on the effectiveness of input validation routines, if any. start() was called on the builder object, which contains tainted data. The tainted data originated from earlier calls to org.apache.spark.deploy.dotnet.DotnetRunner$.main, and org.apache.spark.deploy.dotnet.DotnetRunner.main.
>
> Remediation: Validate all untrusted input to ensure that it conforms to the expected format, using centralized data validation routines when possible. When using blocklists, be sure that the sanitizing routine performs a sufficient number of iterations to remove all instances of disallowed characters. Most APIs that execute system commands also have a "safe" version of the method that takes an array of strings as input rather than a single string, which protects against some forms of command injection.

**Expected behavior**
Veracode Static Scan does not report the issue anymore.