You can consider using .exec() in place of .run() method, profiting the member functions read/readline/readall of WshScriptExec object's StdOut textstream. The result can then be made available to the hta. If the anticipated output is fairly small in size and that the os is win2k or up, it can perform quite well. (You have to read the detail of wshshell's exec method in the documentation.)
For more substantive output, you can consider using .run() with command line redirecting the output to a pre-determined (within the hta) temporary file. Once the cmd process is completed, read the content of the file from within the hta, and delete the file after. This is the cheapest but fairly robust solution with concession in speed and efficiency. It is just a kind of poor (lacking resources) person's message queuing/piping stream to the hta. But hta is by itself with something very practical in mind - just getting a task done, and throwing away until a full-blown program is ready or never to happen, hence, it would be quite acceptable too in my book.