diff --git a/wwwroot/workspace_edit.xterm b/wwwroot/workspace_edit.xterm
index fd85e4b..1fc2e3c 100644
--- a/wwwroot/workspace_edit.xterm
+++ b/wwwroot/workspace_edit.xterm
@@ -1,4 +1,5 @@
 import os
+import shlex
 
 file_id = (params_kw or {}).get('id', '').strip()
 
@@ -29,7 +30,7 @@ if not file_id or not ws_dir:
     r = DictObject()
     r.host = 'localhost'
     r.username = 'pipeline'
-    r.cmdargs = ['echo', '未指定文件']
+    r.cmdargs = ['echo 未指定文件']
     return r
 
 full_path = ws_dir + '/' + file_id
@@ -41,11 +42,11 @@ if not real_full.startswith(real_ws + os.sep):
     r = DictObject()
     r.host = 'localhost'
     r.username = 'pipeline'
-    r.cmdargs = ['echo', '非法路径']
+    r.cmdargs = ['echo 非法路径']
     return r
 
 r = DictObject()
 r.host = 'localhost'
 r.username = 'pipeline'
-r.cmdargs = ['vi', full_path]
+r.cmdargs = ['vi ' + shlex.quote(full_path)]
 return r