Command Injection Vulnerability in GPT-SoVITS-WebUI by RVC Boss
CVE-2025-49836

8.9HIGH

Key Information:

Vendor: Rvc-boss
Status: Gpt-sovits
Vendor: CVE Published:; 15 July 2025

What is CVE-2025-49836?

The GPT-SoVITS-WebUI, developed by RVC Boss, is susceptible to a command injection vulnerability in its user input handling. This flaw exists in the 'change_label' function within the webui.py file, where interactive user input is inadequately sanitized. Consequently, an attacker can manipulate the 'path_list' input, leading to the execution of arbitrary commands on the server. As of now, there are no available patched versions, making it crucial for users to be aware of this security flaw and implement necessary precautions.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch