The fix is for the user to use a smaller $PATH when possible. Any method of checking that the command exists and is executable before trying to execute it leads to TOCTOU race conditions.

https://en.wikipedia.org/wiki/Time-of-check_to_time-of-use