1 files changed, 3 insertions, 0 deletions
diff --git a/process.c b/process.c
index 8eee6f772a..4011aa569f 100644
--- a/process.c
+++ b/process.c
@@ -4755,6 +4755,9 @@ rb_spawn(int argc, const VALUE *argv)
  *  Executes _command..._ in a subshell.
  *  _command..._ is one of following forms.
  *
+ *  This method has potential security vulnerabilities if called with untrusted input;
+ *  see {Command Injection}[command_injection.rdoc].
+ *
  *  [<code>commandline</code>]
  *    command line string which is passed to the standard shell
  *  [<code>cmdname, arg1, ...</code>]