Command Injection Vulnerability in GPT-SoVITS-WebUI by RVC-Boss
CVE-2025-49833

8.9HIGH

Key Information:

Vendor

Rvc-boss

Status
Gpt-sovits
Vendor
CVE Published:
15 July 2025

What is CVE-2025-49833?

GPT-SoVITS-WebUI, a voice conversion and text-to-speech interface developed by RVC-Boss, is susceptible to a command injection flaw found in the open_slice function of webui.py. In versions up to and including 20250228v3, user inputs from slice_opt_root and slice-inp-path are incorporated into system commands without proper validation. This oversight permits malicious users to execute arbitrary commands on the server, posing significant security risks. At present, no patched versions are available to mitigate this vulnerability.

Affected Version(s)

GPT-SoVITS <= 20250228v3

References

https://securitylab.github.com/advisories/GHSL-2025-045_G...
x_refsource_CONFIRM
https://github.com/RVC-Boss/GPT-SoVITS/blob/165882d64f474...
x_refsource_MISC
https://github.com/RVC-Boss/GPT-SoVITS/blob/165882d64f474...
x_refsource_MISC

CVSS V4

Score:
8.9
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2025-49833 : Command Injection Vulnerability in GPT-SoVITS-WebUI by RVC-Boss