{"id":"CVE-2026-122159","kind":"vulnerability","aliases":["CVE-2026-122159"],"related":[],"title":"Edge0-AI Audio8_TTS: path traversal via slow_decode_models argument","description":"A weakness has been identified in Edge0-AI Audio8_TTS up to 1d64afcc2da56222b41ddcf53de7b8bc54be1fb6. This affects the function ArkTtsRuntime.__init__ of the file onnx_runtime_0_1b_int8/arktts_runtime/runtime.py of the component Model Path Resolution. Executing a manipulation of the argument slow_decode_models can lead to path traversal. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. The project was informed of the problem early through an issue report but has not responded yet.","summary":"NVD says a manipulated slow_decode_models value in ArkTtsRuntime.__init__ allows path traversal, rated remote with a public exploit. Reading the code, the value comes from the model's runtime_manifest.json and is joined to the model directory, so the realistic path is a tampered manifest or model package. We found no vendor advisory, no fix and no response from the project.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ai-tooling","audio8-tts","onnx","python","self-hosted","text-to-speech"],"not_affected_if":["manifest-not-attacker-controlled","only-official-model-files","unknown"],"how_to_check":"Check whether you run the 0.1B INT8 runtime (onnx_runtime_0_1b_int8/arktts_runtime) from a checkout at or before commit 1d64afcc2da56222b41ddcf53de7b8bc54be1fb6: git -C <checkout> merge-base --is-ancestor HEAD 1d64afcc2da56222b41ddcf53de7b8bc54be1fb6 (or just compare git rev-parse HEAD). Then open runtime_manifest.json in your model directory and check that the slow_decode_models / slow_decode_model values are plain file names with no '..' or absolute paths. Also check whether anything lets a caller supply the model directory or manifest.","fix":null,"status":"open","published_at":"2026-11-05T03:17:20+00:00","first_seen_at":"2026-11-05T03:31:40+00:00","triaged_at":"2026-11-05T03:33:28+00:00","updated_at":"2026-11-05T03:34:12+00:00","category":"ai-tooling","confidence":0.6,"triage":{"at":"2026-11-05T03:33:28Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Edge0-AI Audio8_TTS: path traversal via slow_decode_models argument","impact":"medium","summary":"A manipulated slow_decode_models argument in the Audio8_TTS model loader lets a caller traverse file paths. The sources say an attacker can trigger it remotely and that a public exploit exists.","audience":"developers","category":"ai-tooling","nicknames":[],"who_cares":["audio8-tts","text-to-speech","onnx"],"confidence":0.6,"fix_status":"none","needs_auth":"unknown","worst_case":"attacker reads or writes files outside the intended model directory","analyst_note":"Confirm which deployments expose slow_decode_models to remote callers and whether the project has responded; the sources say it is a rolling release with no version data and no fix.","how_to_check":"- unknown","plain_action":"","needs_analyst":true,"not_affected_if":["unknown"],"who_is_affected":"The flaw is in ArkTtsRuntime.__init__ in onnx_runtime_0_1b_int8/arktts_runtime/runtime.py, in the Model Path Resolution component. Teams running Audio8_TTS up to commit 1d64afcc2da56222b41ddcf53de7b8bc54be1fb6 that expose the slow_decode_models input should look at it. The sources do not say which deployments accept that input from untrusted callers.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000703,"input_tokens":4387,"output_tokens":528,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm which deployments expose slow_decode_models to remote callers and whether the project has responded; the sources say it is a rolling release with no version data and no fix.","search":"'-122159':15A,18A '-2026':14A,17A '0':119C '1b':120C '1d64afcc2da56222b41ddcf53de7b8bc54be1fb6':108C 'advisori':86B 'affect':110C,180C 'ai':3A,20B,103C 'ai-tool':19B 'allow':44B 'argument':12A,133C 'arkttsruntime.__init__':43B,113C 'attack':143C,163C 'audio8':4A,23B,104C 'audio8-tts':22B 'avail':154C 'code':55B 'come':58B 'compon':124C 'continu':172C 'could':159C 'cve':13A,16A 'decod':10A,39B,135C 'deliveri':173C 'directori':70B 'disclos':186C 'earli':194C 'edge0':2A,102C 'edge0-ai':1A,101C 'execut':128C 'exploit':52B,150C 'file':116C 'fix':88B 'found':83B 'function':112C 'host':29B 'identifi':99C 'inform':178C,190C 'int8/arktts_runtime/runtime.py':121C 'issu':197C 'join':66B 'lead':138C 'made':153C 'manifest':78B 'manipul':37B,130C 'may':144C 'model':11A,40B,61B,69B,80B,125C,136C 'nvd':34B 'onnx':25B,117C 'packag':81B 'path':6A,45B,74B,126C,140C 'perform':146C 'problem':193C 'product':165C 'project':94B,188C 'public':51B,157C 'python':26B 'rate':47B 'read':53B 'realist':73B 'releas':169C,183C 'remot':48B,148C 'report':198C 'resolut':127C 'respond':202C 'respons':91B 'roll':168C 'runtim':118C 'runtime_manifest.json':63B 'say':35B 'self':28B 'self-host':27B 'slow':9A,38B,134C 'speech':33B 'system':170C 'tamper':77B 'text':31B 'text-to-speech':30B 'tool':21B 'travers':7A,46B,141C 'tts':5A,24B,105C 'updat':182C 'use':161C 'util':166C 'valu':41B,57B 'vendor':85B 'version':177C 'via':8A 'weak':96C 'yet':203C","nicknames":[],"mitigations":[],"who_affected":"Teams self-hosting the Audio8_TTS 0.1B INT8 ONNX runtime (ArkTtsRuntime in onnx_runtime_0_1b_int8/arktts_runtime/runtime.py) at or before commit 1d64afcc2da56222b41ddcf53de7b8bc54be1fb6. In the current code on master, slow_decode_models is read from the model's runtime_manifest.json and joined to the model directory, so it is exposed only if an attacker can alter that manifest or the model directory (for example, a tampered model download or a service that lets users choose the model). The CVE text says the attack can be remote, but we found no source showing a remote path to it. Anyone who only uses the official model files unmodified can mostly skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["aitooling","audio8tts","high","onnx","python","selfhosted","texttospeech"],"campaign_type":null,"first_public_at":"2026-11-05T03:17:20+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-122159","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-122159","severity":null,"published_at":"2026-11-05T03:17:20+00:00","modified_at":"2026-11-05T03:17:21+00:00","first_seen_at":"2026-11-05T03:31:40+00:00","fetched_at":"2026-11-05T03:31:40+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-122159:1748","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-122159","severity":null,"published_at":"2026-11-05T03:34:12+00:00","modified_at":"2026-11-05T03:34:12+00:00","first_seen_at":"2026-11-05T03:34:12+00:00","fetched_at":"2026-11-05T03:34:12+00:00","note":"Only NVD (VulDB CNA) as source; no vendor advisory, no fix, rolling release. Read runtime.py on master: slow_decode_models is a manifest key, not a call argument; remote reachability unconfirmed; exploit link not found by me (poc_count 0). Nothing verified. Did not find the issue report.","cites":["https://nvd.nist.gov/vuln/detail/CVE-2026-122159","https://github.com/Edge0-AI/Audio8_TTS/blob/master/onnx_runtime_0_1b_int8/arktts_runtime/runtime.py"]}],"documents":[{"id":72849,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-122159","title":"NVD CVE-2026-122159","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":72850,"url":"https://github.com/Edge0-AI/Audio8_TTS/blob/master/onnx_runtime_0_1b_int8/arktts_runtime/runtime.py","title":"Audio8_TTS runtime.py (0.1B INT8), master","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"exploit_sources":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}