fix(matches): split command into arguments

cmd/matches/extprogram.go

@@ -5,6 +5,7 @@ import (
 	"context"
 	"io"
 	"os/exec"
+	"strings"
 )
 
 // streamObtainer refers to functions that may return either an input stream or
@@ -72,7 +73,8 @@ func (pc *pipeCopy) abort() {
 // from both stderr and stdout to the dataPipe.
 func (pluginInst *matchesPlugin) readFromProgram(ctx context.Context, pipes *readerPipes) {
 	go func() {
-		cmd := exec.Command(pluginInst.dataSource) //nolint:gosec // Command is in fact user-provided
+		args := strings.Split(pluginInst.dataSource, " ")
+		cmd := exec.Command(args[0], args[1:]...) //nolint:gosec // Command is in fact user-provided
 
 		outs := startPipeCopy(func() (io.ReadCloser, error) { return cmd.StdoutPipe() }, pipes)
 		defer outs.close()