One could write a very small custom binary in C/C++/Rust that runs the command, and then give that binary setuid permissions. That binary can simply run a subprocess, and nothing else.