default-rsyncssh.lua in Lsyncd 2.1.5 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in a filename.
http://www.securityfocus.com/bid/71179
http://www.openwall.com/lists/oss-security/2014/11/19/1
http://www.debian.org/security/2015/dsa-3130
http://lists.fedoraproject.org/pipermail/package-announce/2014-December/145131.html
http://lists.fedoraproject.org/pipermail/package-announce/2014-December/145114.html