Command Injection Vulnerability in GPT-SoVITS-WebUI by RVC Boss
CVE-2025-49836

8.9HIGH

Key Information:

Vendor

Rvc-boss

Status
Gpt-sovits
Vendor
CVE Published:
15 July 2025

What is CVE-2025-49836?

The GPT-SoVITS-WebUI, developed by RVC Boss, is susceptible to a command injection vulnerability in its user input handling. This flaw exists in the 'change_label' function within the webui.py file, where interactive user input is inadequately sanitized. Consequently, an attacker can manipulate the 'path_list' input, leading to the execution of arbitrary commands on the server. As of now, there are no available patched versions, making it crucial for users to be aware of this security flaw and implement necessary precautions.

Affected Version(s)

GPT-SoVITS <= 20250228v3

References

https://securitylab.github.com/advisories/GHSL-2025-045_G...
x_refsource_CONFIRM
https://github.com/RVC-Boss/GPT-SoVITS/blob/165882d64f474...
x_refsource_MISC
https://github.com/RVC-Boss/GPT-SoVITS/blob/165882d64f474...
x_refsource_MISC

CVSS V4

Score:
8.9
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2025-49836 : Command Injection Vulnerability in GPT-SoVITS-WebUI by RVC Boss