Log in Start free

Vulnerability · Published Jul 15, 2025 · Assigned by GitHub_M

CVE-2025-49833GHSL-2025-045: GPT-SoVITS Command Injection vulnerability

High 8.9

In plain English

A high-severity command injection in GPT-SoVITS from RVC-Boss. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 3.3% (higher than 89% of all known vulnerabilities).

Severity (CVSS 4.0)8.9High
Exploit odds (30 days)3.3%top 11.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

GPT-SoVITS-WebUI is a voice conversion and text-to-speech webUI. In versions 20250228v3 and prior, there is a command injection vulnerability in the webui.py open_slice function. slice_opt_root and slice-inp-path takes user input, which is passed to the open_slice function, which concatenates the user input into a command and runs it on the server, leading to arbitrary command execution. At time of publication, no known patched versions are available.

Affected products (as reported)

VendorProductVersions
RVC-Boss GPT-SoVITS <= 20250228v3

Weakness: CWE-77 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P

References