Description
GPT-SoVITS through 20250606v2pro contains an OS command injection vulnerability in tools/uvr5/vr.py that allows unauthenticated attackers to execute commands via output folder paths. Attackers can enter shell substitutions like $(...) in the UVR5 WebUI output folder textboxes with mp3 or m4a export to run commands as the server user.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| RVC-Boss | GPT-SoVITS | ≤ 20250606v2pro | — |
References
- GitHub Issue #2319 issue-tracking
- Vulnerable code in tools/uvr5/vr.py technical-description
- https://github.com/RVC-Boss/GPT-SoVITS product
- VulnCheck Advisory: GPT-SoVITS through 20250606v2pro OS Command Injection via UVR5 vr.py third-party-advisory