diff --git a/scripts/check-generated-bindings.mjs b/scripts/check-generated-bindings.mjs
index 355163474..5039ab1d3 100644
--- a/scripts/check-generated-bindings.mjs
+++ b/scripts/check-generated-bindings.mjs
@@ -92,7 +92,13 @@ function snapshot(dir) {
 }
 
 function run(command, args) {
-  const result = spawnSync(command, args, { cwd: repoRoot, encoding: 'utf8' });
+  // Windows 上 `.cmd` / `.bat` 不带 shell 无法执行（Node 修 CVE-2024-27980 后直接 EINVAL），
+  // `npx.cmd` 也不例外；仓库既有脚本统一用 `shell: process.platform === 'win32'`。
+  const result = spawnSync(command, args, {
+    cwd: repoRoot,
+    encoding: 'utf8',
+    shell: process.platform === 'win32',
+  });
   if (result.error) {
     console.error(`无法启动 ${command}：${result.error.message}`);
   }