The espeak-ruby gem before 1.0.3 for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in a string to the speak, save, bytes or bytes_wav method in lib/espeak/speech.rb.

References

• https://nvd.nist.gov/vuln/detail/CVE-2016-10193
• dejan/espeak-ruby#7
• http://www.openwall.com/lists/oss-security/2017/01/31/14
• http://www.openwall.com/lists/oss-security/2017/02/02/5
• dejan/espeak-ruby@5251744
• https://github.com/rubysec/ruby-advisory-db/blob/master/gems/espeak-ruby/CVE-2016-10193.yml