diff --git a/examples/custom_nsis_template/custom.nsi.tmpl b/examples/custom_nsis_template/custom.nsi.tmpl
index 1ed5b41f3..c8cf47606 100644
--- a/examples/custom_nsis_template/custom.nsi.tmpl
+++ b/examples/custom_nsis_template/custom.nsi.tmpl
@@ -675,7 +675,7 @@ Section "Uninstall"
     !insertmacro AbortRetryNSExecWaitLibNsisCmd "rmreg"
 
     DetailPrint "Removing files and folders..."
-    nsExec::Exec 'cmd.exe /D /C RMDIR /Q /S "$INSTDIR"'
+    nsExec::Exec '"$SYSDIR\cmd.exe" /D /C RMDIR /Q /S "$INSTDIR"'
 
     # In case the last command fails, run the slow method to remove leftover
     RMDir /r /REBOOTOK "$INSTDIR"
diff --git a/news/TEMPLATE b/news/TEMPLATE
index c09f3e9a4..c90ee6f38 100644
--- a/news/TEMPLATE
+++ b/news/TEMPLATE
@@ -4,7 +4,7 @@
 
 ### Bug fixes
 
-* <news item>
+* Mitigated a CWE-426 untrusted search path vulnerability in the example `custom.nsi.tmpl` by using a fully qualified path to `$SYSDIR\cmd.exe`.
 
 ### Deprecations