[ CVE-2025-71429 · Published 12 Oct 2026 ]
Vulnerability in RVC-Boss GPT-SoVITS
CVSS 9.8
EPSS 3%No fix listed yet
[ Why it matters ]Priority signals
- Critical severity: CVSS 9.8
[ Description ]Official description
GPT-SoVITS through 20250606v2pro contains an OS command injection vulnerability in tools/uvr5/vr.py that allows unauthenticated attackers to execute commands via output folder paths. Attackers can enter shell substitutions like $(...) in the UVR5 WebUI output folder textboxes with mp3 or m4a export to run commands as the server user.
[ Fixes ]Fixes and patches
No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.