Unsafe Deserialization Vulnerability in GPT-SoVITS-WebUI by RVC-Boss

CVE-2025-49840

What is CVE-2025-49840?

The GPT-SoVITS-WebUI, a tool for voice conversion and text-to-speech, is susceptible to an unsafe deserialization vulnerability in the inference_webui.py file. Specifically, the GPT_dropdown variable processes user input and forwards it to the change_gpt_weights function. Within this function, the user-supplied input, termed gpt_path, is leveraged to load a model using the torch.load method, facilitating the potential for unsafe deserialization. As of now, there are no known patches available to mitigate this vulnerability.

References