Thanks for your report.
I have fixed this:
https://winscp.net/tracker/1760
You can get the updated version of the extension from:
https://winscp.net/eng/docs/extension_compare_files
Or just wait for the next release.

This was me posting - I've no idea why it came up as Guest.

As per title, when you go to compare or create checksums from the Custom Commands dialogue in the Synchronize output, if the files contain spaces it appears to fail because the filenames are not escaped or quoted correctly.

There is a potential for this to be abused by carefully crafted filenames on the remote server as well to potentially run arbitrary code locally, but I haven't tested or PoC'd that of course, and ... well.. it requires the user to take active steps on odd looking files so perhaps this is a pretty low priority concern.

That said, it does make those two options totally useless for files with spaces or reserved characters in them.

PSR recording attached, but marked private in case it leaks passwords or other sensitive information.