Description
GPT-SoVITS through 20250606v2pro contains an OS command injection vulnerability in tools/uvr5/vr.py that allows unauthenticated attackers to execute commands via output folder paths. Attackers can enter shell substitutions like $(...) in the UVR5 WebUI output folder textboxes with mp3 or m4a export to run commands as the server user.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
RVC-Boss GPT-SoVITS
Default version status: unaffected
0 to ≤ 20250606v2proaffected
pkg:github/RVC-Boss/GPT-SoVITSReferences
- https://github.com/RVC-Boss/GPT-SoVITS/issues/2319 ↗
- https://github.com/RVC-Boss/GPT-SoVITS/blob/d7c2210da8c013e81a94bfc7b811a477c99fd506/tools/uvr5/vr.py#L143 ↗
- https://github.com/RVC-Boss/GPT-SoVITS ↗
- https://www.vulncheck.com/advisories/gpt-sovits-through-20250606v2pro-os-command-injection-via-uvr5-vr-py ↗