Nothing open on GitHub. Fix merged in #116826 on 20 Sep 2026. Check it covers your case.
The short answer
- Known?
- Yes. 3 related items grouped here, 1 issue already closed.
- Fix event
- A fix was merged to main in PR #116826. Check it covers your case. No release data is tracked.
- Tracker
- The maintainers' tracker marks this
resolved, deciding PR #116826. That is separate from the fix event. - Still open
- Nothing open on GitHub.
These items address a security issue where control characters or MEDIA: substrings in the TTS output_path parameter could be used to forge extra MEDIA delivery tags. The group includes the bug report and associated fix attempts.
Open issues0
Open PRs0
Fixes on record
-
#116826 fix(tts): output_path can no longer forge extra MEDIA delivery tags via control chars or MEDIA: segments (#116276, salvage #116277)
files:
tests/tools/test_tts_path_traversal.py,tools/path_security.py,tools/tts_tool.py
1 PR closed without merging
From the close comments: merged via another change 1
-
#116277 fix(tts): reject MEDIA directives and control chars in output_path · merged via another change →
00a79a4,#116826,#116276,#116277
Closed issues · 1
- Closed#116276TTS output_path can forge extra MEDIA: delivery tags (control chars and MEDIA: substrings bypass the path gate)
How this cluster was grouped
-
Link evidence (
structural links throughout): every member is connected by structural evidence: shared changed files, or a closing/superseded reference. -
Pairwise link density
0.67: the share of item pairs that carry a link, counting a structural link in full and a relevance-only link at 0.36.1.00means every pair is linked.
Pick up a Lab task
Check whether a fix covers the open issues here, with your own agent. Bring back evidence for maintainers.
Open the LabAt a glance
- Merged PRs
- #116826
- Closed issues
- 1
- Attempts
- 1 PR closed without merging
- Fix link checked
- 20 Sep 2026