GPT-SoVITS-WebUI is a voice conversion and text-to-speech webUI. In versions 20250228v3 and prior, there is a command injection vulnerability in the webui.py open_slice function. slice_opt_root and slice-inp-path takes user input, which is passed to the open_slice function, which concatenates the user input into a command and runs it on the server, leading to arbitrary command execution. At time of publication, no known patched versions are available.
References
Configurations
History
30 Jul 2025, 20:11
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:rvc-boss:gpt-sovits-webui:*:*:*:*:*:*:*:* | |
| First Time |
Rvc-boss
Rvc-boss gpt-sovits-webui |
|
| References | () https://securitylab.github.com/advisories/GHSL-2025-045_GHSL-2025-048_RVC-Boss_GPT-SoVITS/ - Vendor Advisory, Exploit | |
| References | () https://github.com/RVC-Boss/GPT-SoVITS/blob/165882d64f474b3563fa91adc1a679436ae9c3b8/webui.py#L501 - Product | |
| References | () https://github.com/RVC-Boss/GPT-SoVITS/blob/165882d64f474b3563fa91adc1a679436ae9c3b8/webui.py#L889 - Product | |
| References | () https://github.com/RVC-Boss/GPT-SoVITS/blob/165882d64f474b3563fa91adc1a679436ae9c3b8/webui.py#L503 - Product | |
| References | () https://github.com/RVC-Boss/GPT-SoVITS/blob/165882d64f474b3563fa91adc1a679436ae9c3b8/webui.py#L1036 - Product | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 9.8 |
15 Jul 2025, 21:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-07-15 21:15
Updated : 2025-07-30 20:11
NVD link : CVE-2025-49833
Mitre link : CVE-2025-49833
JSON object : View
Products Affected
rvc-boss
- gpt-sovits-webui
CWE
CWE-77
Improper Neutralization of Special Elements used in a Command ('Command Injection')