Skip to content
OpenAdvisories

Vendor

RVC-Boss

11 known vulnerabilities.

RVC-Boss at a glance

Last 12 months
2
Critical · all time
2
Exploited · all time
0
Public exploit · all time
1
New vulnerabilities per month · last 12 months
0 1 1 December 2025: 0 vulnerabilities Dec 2025 January 2026: 0 vulnerabilities February 2026: 0 vulnerabilities March 2026: 0 vulnerabilities Mar April 2026: 0 vulnerabilities May 2026: 0 vulnerabilities June 2026: 0 vulnerabilities Jun July 2026: 1 vulnerability, 1 critical August 2026: 0 vulnerabilities September 2026: 0 vulnerabilities Sep October 2026: 1 vulnerability, 1 critical November 2026: 0 vulnerabilities
Show as table
MonthVulnerabilitiesCritical
Nov 202600
Oct 202611
Sep 202600
Aug 202600
Jul 202611
Jun 202600
May 202600
Apr 202600
Mar 202600
Feb 202600
Jan 202600
Dec 202500
Nov 202500
Oct 202500
Sep 202500
Aug 202500
Jul 202590
Jun 202500
May 202500
Apr 202500
Mar 202500
Feb 202500
Jan 202500
Dec 202400

Products

GPT-SoVITS 11
All Critical High Medium Low Exploited only Public exploit

11 results · Feed

  • Critical 9.8
    CVE-2025-71429

    GPT-SoVITS through 20250606v2pro OS Command Injection via UVR5 vr.py

    GPT-SoVITS through 20250606v2pro contains an OS command injection vulnerability in tools/uvr5/vr.py that allows unauthenticated attackers to execute commands via output folder paths. Attackers can enter shell substitutions like $(...) in the UVR5 WebUI output…

    RVC-Boss GPT-SoVITS
  • Critical 9.8
    CVE-2026-63766 Public exploit

    GPT-SoVITS 20250606v2pro OS Command Injection via webui.py

    GPT-SoVITS through 20250606v2pro contains an OS command injection vulnerability in webui.py where ASR, slice, denoise, and uvr5 functions interpolate unsanitized Gradio textbox values directly into shell commands executed with shell=True. Attackers can inject…

    RVC-Boss GPT-SoVITS
  • High 8.9
    CVE-2025-49841

    GHSL-2025-053: GPT-SoVITS Deserialization of Untrusted Data vulnerability

    GPT-SoVITS-WebUI is a voice conversion and text-to-speech webUI. In versions 20250228v3 and prior, there is an unsafe deserialization vulnerability in process_ckpt.py. The SoVITS_dropdown variable takes user input and passes it to the load_sovits_new function…

    RVC-Boss GPT-SoVITS
  • High 8.9
    CVE-2025-49840

    GHSL-2025-052: GPT-SoVITS Deserialization of Untrusted Data vulnerability

    GPT-SoVITS-WebUI is a voice conversion and text-to-speech webUI. In versions 20250228v3 and prior, there is an unsafe deserialization vulnerability in inference_webui.py. The GPT_dropdown variable takes user input and passes it to the change_gpt_weights funct…

    RVC-Boss GPT-SoVITS
  • High 8.9
    CVE-2025-49839

    GHSL-2025-051: GPT-SoVITS Deserialization of Untrusted Data vulnerability

    GPT-SoVITS-WebUI is a voice conversion and text-to-speech webUI. In versions 20250228v3 and prior, there is an unsafe deserialization vulnerability in bsroformer.py. The model_choose variable takes user input (e.g. a path to a model) and passes it to the uvr …

    RVC-Boss GPT-SoVITS
  • High 8.9
    CVE-2025-49838

    GHSL-2025-050: GPT-SoVITS Deserialization of Untrusted Data vulnerability

    GPT-SoVITS-WebUI is a voice conversion and text-to-speech webUI. In versions 20250228v3 and prior, there is an unsafe deserialization vulnerability in vr.py AudioPreDeEcho. The model_choose variable takes user input (e.g. a path to a model) and passes it to t…

    RVC-Boss GPT-SoVITS
  • High 8.9
    CVE-2025-49837

    GHSL-2025-049: GPT-SoVITS Deserialization of Untrusted Data vulnerability

    GPT-SoVITS-WebUI is a voice conversion and text-to-speech webUI. In versions 20250228v3 and prior, there is an unsafe deserialization vulnerability in vr.py AudioPre. The model_choose variable takes user input (e.g. a path to a model) and passes it to the uvr…

    RVC-Boss GPT-SoVITS
  • High 8.9
    CVE-2025-49836

    GHSL-2025-048: GPT-SoVITS Command Injection vulnerability

    GPT-SoVITS-WebUI is a voice conversion and text-to-speech webUI. In versions 20250228v3 and prior, there is a command injection vulnerability in webui.py change_label function. path_list takes user input, which is passed to the change_label function, which co…

    RVC-Boss GPT-SoVITS
  • High 8.9
    CVE-2025-49835

    GHSL-2025-047: GPT-SoVITS Command Injection vulnerability

    GPT-SoVITS-WebUI is a voice conversion and text-to-speech webUI. In versions 20250228v3 and prior, there is a command injection vulnerability in webui.py open_asr function. asr_inp_dir (and a number of other variables) takes user input, which is passed to the…

    RVC-Boss GPT-SoVITS
  • High 8.9
    CVE-2025-49834

    GHSL-2025-046: GPT-SoVITS Command Injection vulnerability

    GPT-SoVITS-WebUI is a voice conversion and text-to-speech webUI. In versions 20250228v3 and prior, there is a command injection vulnerability in webui.py open_denoise function. denoise_inp_dir and denoise_opt_dir take user input, which is passed to the open_d…

    RVC-Boss GPT-SoVITS
  • High 8.9
    CVE-2025-49833

    GHSL-2025-045: GPT-SoVITS Command Injection vulnerability

    GPT-SoVITS-WebUI is a voice conversion and text-to-speech webUI. In versions 20250228v3 and prior, there is a command injection vulnerability in the webui.py open_slice function. slice_opt_root and slice-inp-path takes user input, which is passed to the open_…

    RVC-Boss GPT-SoVITS