Also, I need to know what "time" means here, because the above fact means that it's possible to restore functionality to the wiki, but at the cost of possibly changing a large number of pages. If it's going to take months for a fix to be in place, that would be reasonable, but not if it's going to be patched next week. Can I have a three-point estimate at least?

tstarling, do you know why it currently works so long as the vorbis=1 parameter is removed? Is this intentional or not?

Assuming the problem is the CVE, Debian believes it was fixed in a more recent version, but the reply on the mailing list doesn't exactly instill me with confidence. I think we do need to decide in relatively short order whether the issues have been addressed and we're going to stick with lilypond, or whether it will never be secure enough for our purposes and we need to start transitioning to something else like MusicXML files.

The cause of the unprintable error problem appears to be that exceptions.error contains the UnicodeMixin class to provide forward compatibility, but it can cause this mangling when one is using a terminal that is not classified as supporting UTF-8 (see http://bugs.python.org/issue8313).