diff --git a/packages/server/src/utils/deleteFolder.ts b/packages/server/src/utils/deleteFolder.ts
index c6db26936..e59392fac 100644
--- a/packages/server/src/utils/deleteFolder.ts
+++ b/packages/server/src/utils/deleteFolder.ts
@@ -1,4 +1,4 @@
-import { execSync } from 'child_process';
+import { spawnSync } from 'child_process';
 export const rmDir = (p: string) => {
-  execSync(`rm -rf ${p}`);
+  spawnSync('rm', ['-rf', p], { stdio: 'inherit' });
 };
diff --git a/packages/server/src/utils/webp.ts b/packages/server/src/utils/webp.ts
index 452d7aebb..31ae40ebb 100644
--- a/packages/server/src/utils/webp.ts
+++ b/packages/server/src/utils/webp.ts
@@ -1,4 +1,4 @@
-import { execSync } from 'child_process';
+import { spawnSync } from 'child_process';
 import { writeFileSync, readFileSync, rmSync } from 'fs';
 export const compressImgToWebp = async (srcImage: Buffer) => {
   const filenameTemp = `temp${Date.now()}`;
@@ -6,7 +6,7 @@ export const compressImgToWebp = async (srcImage: Buffer) => {
   const o = `/tmp/${filenameTemp}.webp`;
   writeFileSync(p, srcImage);
 
-  execSync(`cwebp -q 80 ${p} -o ${o}`);
+  spawnSync('cwebp', ['-q', '80', p, '-o', o], { stdio: 'inherit' });
 
   const f = readFileSync(o);
   rmSync(p);
diff --git a/scripts/releaseDoc.js b/scripts/releaseDoc.js
index 09e6aaaca..e83c46d2e 100644
--- a/scripts/releaseDoc.js
+++ b/scripts/releaseDoc.js
@@ -21,17 +21,21 @@ redirectFrom: /ref/changelog.html
   const newVersion = arr.join('.');
   fs.writeFileSync('doc-version', newVersion, { encoding: 'utf-8' });
 
-  // 添加并应用
-  const { execSync } = require('child_process');
-  execSync(
-    `git add . && git commit -m 'docs: 更新文档' && git tag doc-${newVersion} && git push --follow-tags origin master && git push --tags`,
-    (err, stdout, stderr) => {
-      if (err) {
-        console.log(err);
-        return;
-      }
-      console.log(`stdout: ${stdout}`);
-    },
-  );
+  // Use spawnSync for safer command execution
+  const { spawnSync } = require('child_process');
+  
+  try {
+    // Execute git commands separately for better security and error handling
+    spawnSync('git', ['add', '.'], { stdio: 'inherit' });
+    spawnSync('git', ['commit', '-m', 'docs: 更新文档'], { stdio: 'inherit' });
+    spawnSync('git', ['tag', `doc-${newVersion}`], { stdio: 'inherit' });
+    spawnSync('git', ['push', '--follow-tags', 'origin', 'master'], { stdio: 'inherit' });
+    spawnSync('git', ['push', '--tags'], { stdio: 'inherit' });
+    
+    console.log(`✅ 成功发布文档 v${newVersion}`);
+  } catch (err) {
+    console.log('❌ 发布文档失败:', err);
+    process.exit(1);
+  }
 };
 insertLog();