In Limdu before 0.95 the trainBatch function has a command injection vulnerability. Clients of the Limdu library are unlikely to be aware of this so they might unwittingly write code that contains a vulnerability. This has been patched in 0.95.