Unsafe Deserialization in GPT-SoVITS-WebUI by RVC-Boss

CVE-2025-49837

What is CVE-2025-49837?

GPT-SoVITS-WebUI, a platform for voice conversion and text-to-speech, contains an unsafe deserialization flaw in versions up to 20250228v3. The vulnerability arises when user inputs, specifically the 'model_choose' variable, are directly passed into the 'uvr' function. This function creates an instance of the 'AudioPre' class that improperly loads models using input paths derived from user data. If exploited, this can lead to arbitrary code execution and potential system compromise, posing significant risks to applications leveraging this technology. No patches are available at this time.

References