diff --git a/spec/std/process_spec.cr b/spec/std/process_spec.cr
index 965ed1431cf4..229de961e36c 100644
--- a/spec/std/process_spec.cr
+++ b/spec/std/process_spec.cr
@@ -268,7 +268,7 @@ describe Process do
     end
 
     describe "does not execute batch files" do
-      %w[.bat .Bat .BAT .cmd .cmD .CmD].each do |ext|
+      %w[.bat .Bat .BAT .cmd .cmD .CmD .bat\  .cmd\ ... .bat.\ .].each do |ext|
         it ext do
           with_tempfile "process_run#{ext}" do |path|
             File.write(path, "echo '#{ext}'\n")
diff --git a/src/crystal/system/win32/process.cr b/src/crystal/system/win32/process.cr
index 5249491bbd3f..f1274ad38f66 100644
--- a/src/crystal/system/win32/process.cr
+++ b/src/crystal/system/win32/process.cr
@@ -315,7 +315,7 @@ struct Crystal::System::Process
       # > The problem is that the `cmd.exe` has complicated parsing rules for the command arguments, and programming language runtimes fail to escape the command arguments properly.
       # > Because of this, it’s possible to inject commands if someone can control the part of command arguments of the batch file.
       # https://flatt.tech/research/posts/batbadbut-you-cant-securely-execute-commands-on-windows/
-      if command.byte_slice?(-4, 4).try(&.downcase).in?(".bat", ".cmd")
+      if command.rstrip(". ").byte_slice?(-4, 4).try(&.downcase).in?(".bat", ".cmd")
         raise ::File::Error.from_os_error("Error executing process", WinError::ERROR_BAD_EXE_FORMAT, file: command)
       end