diff --git a/test/test_device.py b/test/test_device.py
index 40fcdb2..d0d0863 100644
--- a/test/test_device.py
+++ b/test/test_device.py
@@ -3,6 +3,7 @@
 import atexit
 import json
 import os
+import shlex
 import shutil
 import subprocess
 import tempfile
@@ -79,12 +80,15 @@ class DeviceTestCase(unittest.TestCase):
         return suite
 
     def do_command(self, args):
+        cli_args = []
+        for arg in args:
+            cli_args.append(shlex.quote(arg))
         if self.interface == 'cli':
-            proc = subprocess.Popen(['hwi ' + ' '.join(args)], stdout=subprocess.PIPE, stderr=subprocess.DEVNULL, shell=True)
+            proc = subprocess.Popen(['hwi ' + ' '.join(cli_args)], stdout=subprocess.PIPE, shell=True)
             result = proc.communicate()
             return json.loads(result[0].decode())
         elif self.interface == 'bindist':
-            proc = subprocess.Popen(['../dist/hwi ' + ' '.join(args)], stdout=subprocess.PIPE, stderr=subprocess.DEVNULL, shell=True)
+            proc = subprocess.Popen(['../dist/hwi ' + ' '.join(cli_args)], stdout=subprocess.PIPE, stderr=subprocess.DEVNULL, shell=True)
             result = proc.communicate()
             return json.loads(result[0].decode())
         elif self.interface == 'stdin':
diff --git a/test/test_keepkey.py b/test/test_keepkey.py
index d20d383..91eef05 100755
--- a/test/test_keepkey.py
+++ b/test/test_keepkey.py
@@ -4,6 +4,7 @@ import argparse
 import atexit
 import json
 import os
+import shlex
 import socket
 import subprocess
 import sys
@@ -82,12 +83,15 @@ class KeepkeyTestCase(unittest.TestCase):
         return suite
 
     def do_command(self, args):
+        cli_args = []
+        for arg in args:
+            cli_args.append(shlex.quote(arg))
         if self.interface == 'cli':
-            proc = subprocess.Popen(['hwi ' + ' '.join(args)], stdout=subprocess.PIPE, stderr=subprocess.DEVNULL, shell=True)
+            proc = subprocess.Popen(['hwi ' + ' '.join(cli_args)], stdout=subprocess.PIPE, stderr=subprocess.DEVNULL, shell=True)
             result = proc.communicate()
             return json.loads(result[0].decode())
         elif self.interface == 'bindist':
-            proc = subprocess.Popen(['../dist/hwi ' + ' '.join(args)], stdout=subprocess.PIPE, stderr=subprocess.DEVNULL, shell=True)
+            proc = subprocess.Popen(['../dist/hwi ' + ' '.join(cli_args)], stdout=subprocess.PIPE, stderr=subprocess.DEVNULL, shell=True)
             result = proc.communicate()
             return json.loads(result[0].decode())
         elif self.interface == 'stdin':
diff --git a/test/test_trezor.py b/test/test_trezor.py
index 366ee17..d3f42f8 100755
--- a/test/test_trezor.py
+++ b/test/test_trezor.py
@@ -4,6 +4,7 @@ import argparse
 import atexit
 import json
 import os
+import shlex
 import socket
 import subprocess
 import sys
@@ -82,12 +83,15 @@ class TrezorTestCase(unittest.TestCase):
         return suite
 
     def do_command(self, args):
+        cli_args = []
+        for arg in args:
+            cli_args.append(shlex.quote(arg))
         if self.interface == 'cli':
-            proc = subprocess.Popen(['hwi ' + ' '.join(args)], stdout=subprocess.PIPE, stderr=subprocess.DEVNULL, shell=True)
+            proc = subprocess.Popen(['hwi ' + ' '.join(cli_args)], stdout=subprocess.PIPE, stderr=subprocess.DEVNULL, shell=True)
             result = proc.communicate()
             return json.loads(result[0].decode())
         elif self.interface == 'bindist':
-            proc = subprocess.Popen(['../dist/hwi ' + ' '.join(args)], stdout=subprocess.PIPE, stderr=subprocess.DEVNULL, shell=True)
+            proc = subprocess.Popen(['../dist/hwi ' + ' '.join(cli_args)], stdout=subprocess.PIPE, stderr=subprocess.DEVNULL, shell=True)
             result = proc.communicate()
             return json.loads(result[0].decode())
         elif self.interface == 'stdin':