CVE-2025-71429

Received Received - Intake

GPT-SoVITS OS Command Injection via UVR5 WebUI Export Path

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: VulnCheck

Description

GPT-SoVITS through 20250606v2pro contains an OS command injection vulnerability in tools/uvr5/vr.py that allows unauthenticated attackers to execute commands via output folder paths. Attackers can enter shell substitutions like $(...) in the UVR5 WebUI output folder textboxes with mp3 or m4a export to run commands as the server user.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-12

Last Modified

2026-10-12

Generated

2026-10-13

AI Q&A

2026-10-13

EPSS Evaluated

N/A

NVD

CVE-2025-71429

Affected Vendors & Products

Vendor	Product	Version / Range
RVC-Boss	GPT-SoVITS	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-78	The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Attack-Flow Graph

Executive Summary

GPT-SoVITS through 20250606v2pro has an OS command injection flaw in tools/uvr5/vr.py. Unauthenticated attackers can exploit this by entering shell substitutions like $(...) in the UVR5 WebUI output folder textboxes when exporting files as mp3 or m4a. This allows them to run arbitrary commands on the server as the server user.

Detection Guidance

Check for suspicious command substitutions like $(...) in UVR5 WebUI output folder paths. Review server logs for unexpected command executions or unusual file paths containing shell metacharacters. Inspect GPT-SoVITS logs for errors related to path handling in tools/uvr5/vr.py.

Impact Analysis

This vulnerability allows attackers to execute arbitrary commands on the server. This could lead to unauthorized access, data theft, system compromise, or disruption of services. If the server handles sensitive data, attackers might exfiltrate or manipulate it.

Compliance Impact

This vulnerability could lead to data breaches, violating GDPR and HIPAA requirements for data protection and confidentiality. Organizations may face legal penalties, fines, and reputational damage due to non-compliance with these regulations.

Mitigation Strategies

Update GPT-SoVITS to the latest version. Disable or restrict access to the UVR5 WebUI if not required. Sanitize input fields in the WebUI to block shell substitutions like $(...). Monitor system logs for signs of exploitation and restrict user permissions for the server process.

Hi! I’m here to help you understand CVE-2025-71429. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70