command is hardcoded, however, attacker cannot control argument. but since program doesnt specify an absolute path for make, attacker can modify their $path to point to a malicious binary named make.