festivaltts4r allows arbitrary command execution (GHSA-f7f4-5w9j-23p2)
Published: 2017-10-24T18:33:35Z
Aliases: CVE-2016-10194
Severity: CRITICAL · CWE: CWE-77

The festivaltts4r gem for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in a string to the (1) `to_speech` or (2) `to_mp3` method in `lib/festivaltts4r/festival4r.rb`.

Affected packages:
package: ecosystem: RubyGems
name: festivaltts4r
ranges: type: ECOSYSTEM
events: introduced: 0
last_affected: 0.2.0