espeak-ruby allows arbitrary command execution (GHSA-4jm3-pfpf-h54p)
Published: 2017-10-24T18:33:35Z
Aliases: CVE-2016-10193
Severity: CRITICAL · CWE: CWE-284

The espeak-ruby gem before 1.0.3 for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in a string to the `speak`, `save`, `bytes` or `bytes_wav` method in `lib/espeak/speech.rb`.

Affected packages:
package: ecosystem: RubyGems
name: espeak-ruby
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 1.0.3