CVE-2025-49834
BaseFortify
Publication date: 2025-07-15
Last updated on: 2025-07-30
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| rvc-boss | gpt-sovits-webui | to 20250228v3 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-77 | The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a command injection flaw in GPT-SoVITS-WebUI versions 20250228v3 and earlier. Specifically, the webui.py file's open_denoise function takes user input from denoise_inp_dir and denoise_opt_dir parameters and concatenates this input into a command that is executed on the server. Because the user input is not properly sanitized, an attacker can inject arbitrary commands to be executed on the server.
How can this vulnerability impact me? :
This vulnerability allows an attacker to execute arbitrary commands on the server running GPT-SoVITS-WebUI. This can lead to full compromise of the server, including unauthorized access to data, modification or deletion of files, disruption of service, and potentially using the server as a foothold to attack other systems.
What immediate steps should I take to mitigate this vulnerability?
Since no patched versions are available at this time, immediate mitigation steps include restricting access to the vulnerable GPT-SoVITS-WebUI service to trusted users only, disabling or restricting the functionality that uses the open_denoise function if possible, and monitoring for any suspicious command execution activity on the server. Additionally, consider isolating the service in a restricted environment to limit potential impact.