Unsafe Deserialization Vulnerability in GPT-SoVITS-WebUI by RVC-Boss

CVE-2025-49838

What is CVE-2025-49838?

The GPT-SoVITS-WebUI by RVC-Boss contains an unsafe deserialization vulnerability that arises from how user input is handled in the vr.py file. Specifically, in versions up to 20250228v3, the model_choose variable accepts a path to a model, which is then improperly utilized in the uvr function. The model_path, influenced by user input, is used in the AudioPreDeEcho class to load models via torch.load without sufficient validation, exposing the application to potential remote code execution through specially crafted inputs. At the time of publication, no patches are available, leaving affected users vulnerable.

References