Awesome spawn contains OS command injection vulnerability, which allows execution of additional commands passed to Awesome spawn as arguments, e.g. AwesomeSpawn.run('ls',:params => {'-l' => ";touch haxored"}). If untrusted input was included in command arguments, attacker could use this flaw to execute arbitrary command.