htags in GNU Global through 6.6.12 allows code execution in situations where dbpath (aka -d) is untrusted, because shell metacharacters may be used.
CWE-94 Improper Control of Generation of Code ('Code Injection')