---
id: "CVE-2026-122159"
kind: "vulnerability"
aliases: ["CVE-2026-122159"]
title: "Edge0-AI Audio8_TTS: path traversal via slow_decode_models argument"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "ai-tooling"
products: []
ecosystems: []
tags: ["ai-tooling", "audio8-tts", "onnx", "python", "self-hosted", "text-to-speech"]
not_affected_if: ["manifest-not-attacker-controlled", "only-official-model-files", "unknown"]
published_at: "2026-11-05T03:17:20+00:00"
first_seen_at: "2026-11-05T03:31:40+00:00"
updated_at: "2026-11-05T03:34:12+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-122159", "first_seen_at": "2026-11-05T03:31:40+00:00"}, {"source": "analyst", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-122159", "first_seen_at": "2026-11-05T03:34:12+00:00", "cites": ["https://nvd.nist.gov/vuln/detail/CVE-2026-122159", "https://github.com/Edge0-AI/Audio8_TTS/blob/master/onnx_runtime_0_1b_int8/arktts_runtime/runtime.py"]}]
exploit_sources: []
---

# Edge0-AI Audio8_TTS: path traversal via slow_decode_models argument

NVD says a manipulated slow_decode_models value in ArkTtsRuntime.__init__ allows path traversal, rated remote with a public exploit. Reading the code, the value comes from the model's runtime_manifest.json and is joined to the model directory, so the realistic path is a tampered manifest or model package. We found no vendor advisory, no fix and no response from the project.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

Check whether you run the 0.1B INT8 runtime (onnx_runtime_0_1b_int8/arktts_runtime) from a checkout at or before commit 1d64afcc2da56222b41ddcf53de7b8bc54be1fb6: git -C <checkout> merge-base --is-ancestor HEAD 1d64afcc2da56222b41ddcf53de7b8bc54be1fb6 (or just compare git rev-parse HEAD). Then open runtime_manifest.json in your model directory and check that the slow_decode_models / slow_decode_model values are plain file names with no '..' or absolute paths. Also check whether anything lets a caller supply the model directory or manifest.

## Timeline

- 2026-11-05T03:31:40+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-122159
- 2026-11-05T03:34:12+00:00 analyst https://nvd.nist.gov/vuln/detail/CVE-2026-122159 — Only NVD (VulDB CNA) as source; no vendor advisory, no fix, rolling release. Read runtime.py on master: slow_decode_models is a manifest key, not a call argument; remote reachability unconfirmed; exploit link not found by me (poc_count 0). Nothing verified. Did not find the issue report.

## Documents

- [advisory] NVD CVE-2026-122159 https://nvd.nist.gov/vuln/detail/CVE-2026-122159
- [describes] Audio8_TTS runtime.py (0.1B INT8), master https://github.com/Edge0-AI/Audio8_TTS/blob/master/onnx_runtime_0_1b_int8/arktts_runtime/runtime.py

## From the sources

A weakness has been identified in Edge0-AI Audio8_TTS up to 1d64afcc2da56222b41ddcf53de7b8bc54be1fb6. This affects the function ArkTtsRuntime.__init__ of the file onnx_runtime_0_1b_int8/arktts_runtime/runtime.py of the component Model Path Resolution. Executing a manipulation of the argument slow_decode_models can lead to path traversal. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. The project was informed of the problem early through an issue report but has not responded yet.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_