Description
GPT-SoVITS through 20250606v2pro contains an OS command injection vulnerability in tools/uvr5/vr.py that allows unauthenticated attackers to execute commands via output folder paths. Attackers can enter shell substitutions like $(...) in the UVR5 WebUI output folder textboxes with mp3 or m4a export to run commands as the server user.
References
- www.cve.org/CVERecord ↗
- nvd.nist.gov/vuln/detail/CVE-2025-71429 ↗
- github.com/RVC-Boss/GPT-SoVITS ↗
- github.com/RVC-Boss/GPT-SoVITS/blob/d7c2210da8c013e81a94bfc7b811a477c99fd506/tools/uvr5/vr.py ↗
- github.com/RVC-Boss/GPT-SoVITS/issues/2319 ↗
- www.vulncheck.com/advisories/gpt-sovits-through-20250606v2pro-os-command-injection-via-uvr5-vr-py ↗
Related CVEs
← CVE Index: search every CVE from the last 30 days
This product uses the NVD API but is not endorsed or certified by the NVD. CVSS scores do not establish exploitation.