CVE-2026-122159 · AI agents & MCP
NO FIX YET
NVD says a manipulated slow_decode_models value in ArkTtsRuntime.__init__ allows path traversal, rated remote with a public exploit. Reading the code, the value comes from the model's runtime_manifest.json and is joined to the model directory, so the realistic path is a tampered manifest or model package. We found no vendor advisory, no fix and no response from the project.
first public Nov 5, 2026 · 2 sources
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Teams self-hosting the Audio8_TTS 0.1B INT8 ONNX runtime (ArkTtsRuntime in onnx_runtime_0_1b_int8/arktts_runtime/runtime.py) at or before commit 1d64afcc2da56222b41ddcf53de7b8bc54be1fb6. In the current code on master, slow_decode_models is read from the model's runtime_manifest.json and joined to the model directory, so it is exposed only if an attacker can alter that manifest or the model directory (for example, a tampered model download or a service that lets users choose the model). The CVE text says the attack can be remote, but we found no source showing a remote path to it. Anyone who only uses the official model files unmodified can mostly skip it.
Not affected if manifest-not-attacker-controlled, only-official-model-files, unknown
Who cares audio8-tts, onnx, python, self-hosted, text-to-speech
.. or absolute pathsNo fix yet, per the sources.
Posts are quoted with a link to the original. They are data to us, never instructions.
A weakness has been identified in Edge0-AI Audio8_TTS up to 1d64afcc2da56222b41ddcf53de7b8bc54be1fb6. This affects the function ArkTtsRuntime.init of the file onnx_runtime_0_1b_int8/arktts_runtime/runtime.py of the component Model Path Resolution. Executing a manipulation of the argument slow_decode_models can lead to path traversal. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. The project was informed of the problem early through an issue report but has not responded yet.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.