CVE-2016-10194: The festivaltts4r gem for Ruby allows remote attackers to execute arbitrary commands via shell metacharacte...

Security readout for executives and security teams

CVE-2016-10194 is a command injection issue in the Ruby festivaltts4r text-to-speech gem. If an application sends attacker-controlled text into the affected conversion methods, the host running that code may execute unintended operating-system commands. The sources do not provide affected versions, CVSS, or a named patch. Most likely exposed systems are Ruby applications that include the festivaltts4r gem and convert user-supplied text to speech or MP3. Internal-only batch usage with trusted input is lower risk, but still warrants review because the affected version range is not documented. Prioritize investigation for internet-facing or customer-input applications using this gem, because successful exploitation could become host-level command execution. If the gem is absent, no action is needed beyond recording non-exposure. Mitigation focus: Inventory Ruby applications for festivaltts4r usage.; Do not pass untrusted text into to_speech or to_mp3.; Check the project issue and maintainer guidance for fixed releases or workarounds..

Prepared

Jun 13, 2026, 06:02 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.