--- Please enter the report below this line. ---

In the default-direct.lua file in the "event.etype == 'Move'" branch
instead of using a direct fork/exec a shell in spawned. Its arguments
aren't quoted so one can inject additional parameters using whitespace
characters.

File paths passed to the lua script seem to be absolute, so at least
other branches doing direct exec but not using '--' are probably safe.

Examples can be tested after entering the source directory.

Example 1:
$ touch ' '
$ mv ' ' sthelse
Causes rm -rf on target (the whole directory)

Example 2:
$ touch -- ' -t tmp'
$ mv ' -t tmp' ' sthelse'
Moves the target directory and its contents to /tmp. lsyncd's cwd is /.

I attach a patch, possibly correct -- I don't know lua.

Debian Release: 8.2
  500 stable          security.debian.org
  500 stable          ftp.pl.debian.org
   50 testing         security.debian.org
   50 testing         ftp.pl.debian.org
--- Package information. ---
Package's Depends field is empty.

Package's Recommends field is empty.

Package's Suggests field is empty.

thanks to btrfs and zfs not much lost
But anyway - I issued "lsyncd -rsync /source/path/ ." (Point meaning
"here") and it seems that it ate through everything that was nfs mounted
or shared...