diff --git a/features/core-check-update-db.feature b/features/core-check-update-db.feature
index bf34949b..84332d28 100644
--- a/features/core-check-update-db.feature
+++ b/features/core-check-update-db.feature
@@ -98,3 +98,12 @@ Feature: Check if WordPress database update is needed
       Error: This is not a multisite installation.
       """
     And the return code should be 1
+
+  Scenario: Check database update on network installation safely handles site domain/path with special characters
+    Given a WP multisite install
+    And I run `wp db query "INSERT INTO wp_blogs (site_id, domain, path, registered, last_updated) VALUES (1, 'example.com', '/x\\\$(touch /tmp/wpcli_test_check_db_marker)/', NOW(), NOW());"`
+
+    When I run `wp core check-update-db --network`
+    Then the return code should be 0
+    And the /tmp/wpcli_test_check_db_marker file should not exist
+
diff --git a/src/Core_Command.php b/src/Core_Command.php
index b2cb31ec..081a31b7 100644
--- a/src/Core_Command.php
+++ b/src/Core_Command.php
@@ -1510,7 +1510,7 @@ public function check_update_db( $args, $assoc_args ) {
 			foreach ( $it as $blog ) {
 				++$total;
 				$url = $blog->domain . $blog->path;
-				$cmd = "--url={$url} core check-update-db";
+				$cmd = Utils\esc_cmd( '--url=%s core check-update-db', $url );
 
 				/**
 				 * @var object{stdout: string, stderr: string, return_code: int} $process
@@ -1628,7 +1628,7 @@ public function update_db( $args, $assoc_args ) {
 			foreach ( $it as $blog ) {
 				++$total;
 				$url = $blog->domain . $blog->path;
-				$cmd = "--url={$url} core update-db";
+				$cmd = Utils\esc_cmd( '--url=%s core update-db', $url );
 				if ( $dry_run ) {
 					$cmd .= ' --dry-run';
 				}