espeak-ruby allows arbitrary command execution

CRITICAL 9.8CVE-2016-10193 · GHSA-4jm3-pfpf-h54p · Published 03/03/2017 · updated 17/06/2026

In short

CVE-2016-10193 is a CRITICAL (CVSS 9.8) vulnerability affecting espeak-ruby, espeak-ruby (espeak-ruby project).
Chance of exploitation in the next 30 days (EPSS): 2.4%, higher than 84.5% of all vulnerabilities.
Fix: update to 1.0.3 or later.

Package	Affected versions	Patched versions
espeak-ruby RubyGems	`< 1.0.3`	`1.0.3`
espeak-ruby espeak-ruby_project	`≤ 1.0.2`	No fix yet

Description

The espeak-ruby gem before 1.0.3 for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in a string to the speak, save, bytes or bytes_wav method in lib/espeak/speech.rb.

NVD description

The espeak-ruby gem before 1.0.3 for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in a string to the speak, save, bytes or bytes_wav method in lib/espeak/speech.rb.

References

nvd.nist.gov/vuln/detail/CVE-2016-10193 · ADVISORY
dejan/espeak-ruby · WEB
dejan/espeak-ruby commit 5251744 · WEB
dejan/espeak-ruby · PACKAGE
rubysec/ruby-advisory-db · WEB
openwall.com/lists/oss-security/2017/01/31/14 · WEB
openwall.com/lists/oss-security/2017/02/02/5 · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free