Log in Start free

Vulnerability · Published Jul 15, 2025 · Assigned by GitHub_M

CVE-2025-49834GHSL-2025-046: GPT-SoVITS Command Injection vulnerability

High 8.9

In plain English

A high-severity command injection in GPT-SoVITS from RVC-Boss. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 3.3% (higher than 88% of all known vulnerabilities).

Severity (CVSS 4.0)8.9High
Exploit odds (30 days)3.3%top 11.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

GPT-SoVITS-WebUI is a voice conversion and text-to-speech webUI. In versions 20250228v3 and prior, there is a command injection vulnerability in webui.py open_denoise function. denoise_inp_dir and denoise_opt_dir take user input, which is passed to the open_denoise function, which concatenates the user input into a command and runs it on the server, leading to arbitrary command execution. At time of publication, no known patched versions are available.

Affected products (as reported)

VendorProductVersions
RVC-Boss GPT-SoVITS <= 20250228v3

Weakness: CWE-77 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P

References