critical9.8

CVE-2025-71429

GPT-SoVITS through 20250606v2pro contains an OS command injection vulnerability in tools/uvr5/vr.py that allows unauthenticated attackers to execute commands v…

Impact

GPT-SoVITS through 20250606v2pro contains an OS command injection vulnerability in tools/uvr5/vr.py that allows unauthenticated attackers to execute commands via output folder paths. Attackers can enter shell substitutions like $(...) in the UVR5 WebUI output folder textboxes with mp3 or m4a export to run commands as the server user.

Affected packages

This record carries no package version data, so it cannot be matched against a dependency list automatically. Read the advisory and compare your version by hand.

Weakness classification

CWE-78

References

NVD record
CVE.org record
https://github.com/RVC-Boss/GPT-SoVITS
https://github.com/RVC-Boss/GPT-SoVITS/blob/d7c2210da8c013e81a94bfc7b811a477c99fd506/tools/uvr5/vr.py#L143
https://github.com/RVC-Boss/GPT-SoVITS/issues/2319
https://www.vulncheck.com/advisories/gpt-sovits-through-20250606v2pro-os-command-injection-via-uvr5-vr-py