RVC-Boss GPT-SoVITS vulnerabilities
🔔 Create alert RSS Version checker
Published CVEs affecting RVC-Boss GPT-SoVITS: 2 record(s), with affected versions and fixes.
CVE-2025-71429
Critical · 9.8
CWE-78 Oct 12, 2026
GPT-SoVITS through 20250606v2pro OS Command Injection via UVR5 vr.py
GPT-SoVITS through 20250606v2pro contains an OS command injection vulnerability in tools/uvr5/vr.py that allows unauthenticated attackers to execute commands via output folder paths. Attackers can enter shell substitutions like $(...) in the UVR5 WebUI output folder textboxes with mp3 or m4a export to run commands as the server user.
CVE-2026-63766
Critical · 9.8
CWE-78 Jul 20, 2026
GPT-SoVITS 20250606v2pro OS Command Injection via webui.py
GPT-SoVITS through 20250606v2pro contains an OS command injection vulnerability in webui.py where ASR, slice, denoise, and uvr5 functions interpolate unsanitized Gradio textbox values directly into shell commands executed with shell=True. Attackers can inject shell metacharacters through path parameters to execute arbitrary OS commands as the server process user without authentication.