CVE-2025-71429

CriticalCVSS 9.8

Published: 12/10/2026(UTC)Translated: 13/10/2026(UTC)NVD NIST

Summary

GPT-SoVITS through 20250606v2pro contains an OS command injection vulnerability in tools/uvr5/vr.py that allows unauthenticated attackers to execute commands via output folder paths. Attackers can enter shell substitutions like $(...) in the UVR5 WebUI output folder textboxes with mp3 or m4a export to run commands as the server user.

Risk Assessment

An unauthenticated attacker can execute arbitrary commands on the server, potentially leading to full system and data compromise.

Recommendation

Upgrade GPT-SoVITS to the latest version. Restrict access to UVR5 WebUI and do not expose it publicly without security measures.

Other vulnerabilities in GPT-SoVITS

CVE-2026-63766Critical
GPT-SoVITS through 20250606v2pro contains an OS command injection vulnerability in webui.py where ASR, slice, denoise, and uvr5 functions interpolate unsanitized Gradio textbox values directly into shell commands executed with shell=True. Attackers can inject shell metacharacters through path parameters to execute arbitrary OS commands as the server process user without authentication.

Original NVD description (English source)

Vulnerability data from NVD (NIST) · CISA KEV · EPSS