Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.3
CVE-2025-71429: GPT-SoVITS allows attackers to run commands via output folder field
CVE-2025-71429 · published 6 days ago
Summary
The GPT-SoVITS software version up to 20250606v2pro lets an unauthenticated person type special text (like $(...)) into the UVR5 WebUI output folder box and cause the server to execute any command it wants. This can let attackers take control of the server or access data. Apply the vendor's update or patch and restrict who can use the WebUI to stop the risk.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| rvc-boss | gpt-sovits | <= 20250606v2pro |
Original advisory text
GPT-SoVITS through 20250606v2pro OS Command Injection via UVR5 vr.py
GPT-SoVITS through 20250606v2pro contains an OS command injection vulnerability in tools/uvr5/vr.py that allows unauthenticated attackers to execute commands via output folder paths. Attackers can enter shell substitutions like $(...) in the UVR5 WebUI output folder textboxes with mp3 or m4a export to run commands as the server user.
References
- https://github.com/RVC-Boss/GPT-SoVITS/issues/2319
- https://github.com/RVC-Boss/GPT-SoVITS/blob/d7c2210da8c013e81a94bfc7b811a477c99f...
- https://github.com/RVC-Boss/GPT-SoVITS
- https://www.vulncheck.com/advisories/gpt-sovits-through-20250606v2pro-os-command...
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/71xxx/CVE-2025-71429... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2025-71429 Vendor Advisory
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker full control
Type
CWE-78OS Command Injection
Timeline
Published12 Oct 2026
Updated16 Oct 2026
First seen12 Oct 2026
Track software like this
Free during beta