The bug here is not related to virtualization, but a footgun as old as C stdlib: system() that doesn't take arguments separately, and instead relies on shell escaping by the application.

The only point of system(3) is to invoke the OS shell, if you do not want that use exec(3).