Command Injection Vulnerability in GPT-SoVITS-WebUI by RVC-Boss
CVE-2025-49835

8.9HIGH

Key Information:

Vendor

Rvc-boss

Status
Gpt-sovits
Vendor
CVE Published:
15 July 2025

What is CVE-2025-49835?

The GPT-SoVITS-WebUI, a text-to-speech and voice conversion tool developed by RVC-Boss, has a command injection vulnerability affecting versions 20250228v3 and prior. This weakness resides in the handling of user input within the open_asr function in webui.py. Specifically, variables such as asr_inp_dir are improperly sanitized, allowing an attacker to inject arbitrary commands that are executed on the server. This poses a significant risk to the integrity of the server, as malicious users can exploit this flaw to execute untrusted commands. As of the latest information available, no patches have been released to mitigate this issue.

Affected Version(s)

GPT-SoVITS <= 20250228v3

References

https://securitylab.github.com/advisories/GHSL-2025-045_G...
x_refsource_CONFIRM
https://github.com/RVC-Boss/GPT-SoVITS/blob/165882d64f474...
x_refsource_MISC
https://github.com/RVC-Boss/GPT-SoVITS/blob/165882d64f474...
x_refsource_MISC

CVSS V4

Score:
8.9
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2025-49835 : Command Injection Vulnerability in GPT-SoVITS-WebUI by RVC-Boss