command_wrap.rb in the command_wrap Gem for Ruby allows remote malicious users to execute arbitrary commands via shell metacharacters in a URL or filename.
rubygems command wrap -