Unsafe Deserialization in GPT-SoVITS-WebUI by RVC-Boss

CVE-2025-49839

What is CVE-2025-49839?

The GPT-SoVITS-WebUI, a voice conversion and text-to-speech application by RVC-Boss, contains a vulnerability due to unsafe deserialization in the bsroformer.py script. This issue arises when the model_choose variable accepts user input—such as a model path—and subsequently passes it to the uvr function. The input is then used to create an instance of the Roformer_Loader class, which loads the model using torch.load, facilitated by appending a .ckpt extension to the path. This process permits potential exploitation by allowing malicious models to be loaded. As of the publication date, no patched versions exist, underscoring the urgency for users to remain vigilant.

References