CVE-2026-122159: Edge0-AI Audio8_TTS Model Path Resolution runtime.py ArkTtsRuntime.__init__ path traversal
A weakness has been identified in Edge0-AI Audio8TTS up to 1d64afcc2da56222b41ddcf53de7b8bc54be1fb6. This affects the function ArkTtsRuntime.init of the file onnxruntime01bint8/arkttsruntime/runtime.py of the component Model Path Resolution. Executing a manipulation of the argument slowdecodemodels can lead to path traversal. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. The project was informed of the problem early through an issue report but has not responded yet.
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
The attack is remote and requires no privileges, but it requires user interaction. Exploitation involves manipulating the slow_decode_models argument supplied to ArkTtsRuntime.__init__.
Which deployments should be treated as potentially exposed?
Deployments using the affected Model Path Resolution code in onnx_runtime_0_1b_int8/arktts_runtime/runtime.py should be reviewed, particularly where an untrusted party can influence the slow_decode_models argument. The affected project uses a rolling release model, so no affected or fixed release versions are identified.
Is a vendor fix or response available?
The available information does not identify a fixed revision or mitigation. The project was notified through an issue report but had not responded at the time of publication.