GPT-SoVITS: OS command injection in UVR5 WebUI output folder
Summary
GPT-SoVITS through 20250606v2pro contains an OS command injection in tools/uvr5/vr.py, the UVR5 vocal separation feature of the WebUI. An unauthenticated attacker who can reach the WebUI can enter shell substitutions such as $(...) into the output folder fields when exporting as mp3 or m4a and run commands as the server user. The CVSS 4.0 score is 9.3 (critical), but no vendor advisory or confirmed fix was found.
Affected
- RVC-Boss GPT-SoVITS 0 through 20250606v2pro
Fixed in
Unknown. No vendor-confirmed fixed version was found. OSV lists 20250606v2pro and commit d7c2210da8c013e81a94bfc7b811a477c99fd506 as fixed, which conflicts with the CVE references. Treat the fix status as unverified.
Workaround
- Keep the WebUI off the internet and out of general office or guest networks
- Restrict access to named admin hosts, for example via a dedicated VLAN
- Place the WebUI behind an authenticated reverse proxy or VPN
- Run the service under a dedicated low-privilege account without access to secrets
- Disable UVR5 features if they are not needed
Exploitation
- No exploitation in the wild reported; secondary sources only, CISA KEV not verified
- CISA SSVC: exploitation none, automatable yes, technical impact total
- A public issue (#2847) describes a related command injection; this is unverified
Our recommendation
- Identify all GPT-SoVITS instances, including developer workstations and cloud GPU hosts
- Remove public exposure immediately and restrict access as described above
- Monitor these hosts for unusual outbound connections and unexpected child processes
- Apply the upstream fix once a fix is confirmed in the repository
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- VulnCheck advisory www.vulncheck.com
- Upstream issue #2319 github.com
- Upstream repository github.com
- Vulnerable code (vr.py, commit d7c2210) github.com
- OSV osv.dev
- TheHackerWire www.thehackerwire.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 02:26.
Original description (NVD)
GPT-SoVITS through 20250606v2pro contains an OS command injection vulnerability in tools/uvr5/vr.py that allows unauthenticated attackers to execute commands via output folder paths. Attackers can enter shell substitutions like $(...) in the UVR5 WebUI output folder textboxes with mp3 or m4a export to run commands as the server user.
NVD references (4)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.