CyberRota Analysis
AI-GeneratedThe vulnerability allows attackers to exploit unsanitized input in the webui.py file of GPT-SoVITS, enabling OS command injection through specific functions that directly incorporate Gradio textbox values into shell commands. This critical flaw could lead to arbitrary command execution as the server process user, posing a significant risk to system integrity and confidentiality. Organizations using affected versions should prioritize immediate remediation to mitigate potential exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
GPT-SoVITS through 20250606v2pro contains an OS command injection vulnerability in webui.py where ASR, slice, denoise, and uvr5 functions interpolate unsanitized Gradio textbox values directly into shell commands executed with shell=True. Attackers can inject shell metacharacters through path parameters to execute arbitrary OS commands as the server process user without authentication.