Unsafe Deserialization in GPT-SoVITS-WebUI by RVC-Boss
CVE-2025-49837

8.9HIGH

Key Information:

Vendor

Rvc-boss

Status
Gpt-sovits
Vendor
CVE Published:
15 July 2025

What is CVE-2025-49837?

GPT-SoVITS-WebUI, a platform for voice conversion and text-to-speech, contains an unsafe deserialization flaw in versions up to 20250228v3. The vulnerability arises when user inputs, specifically the 'model_choose' variable, are directly passed into the 'uvr' function. This function creates an instance of the 'AudioPre' class that improperly loads models using input paths derived from user data. If exploited, this can lead to arbitrary code execution and potential system compromise, posing significant risks to applications leveraging this technology. No patches are available at this time.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

GPT-SoVITS <= 20250228v3

References

https://securitylab.github.com/advisories/GHSL-2025-049_G...
x_refsource_CONFIRM
https://github.com/RVC-Boss/GPT-SoVITS/blob/165882d64f474...
x_refsource_MISC
https://github.com/RVC-Boss/GPT-SoVITS/blob/165882d64f474...
x_refsource_MISC

CVSS V4

Score:
8.9
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.