GPT-SoVITS-WebUI — Command Injection (CVE-2025-49833)
Date: 2025-07
Affected: rvc-boss/gpt-sovits-webui
Attack vector: command-injection
Category: vulnerability-disclosure
Severity: Critical
CVE: CVE-2025-49833
CVE-2025-49834
CVE-2025-49835
CWE: CWE-77
CVSS: 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

GPT-SoVITS-WebUI is a voice conversion and text-to-speech webUI. In versions 20250228v3 and prior, there is a command injection vulnerability in the webui.py open_slice function. slice_opt_root and slice-inp-path takes user input, which is passed to the open_slice function, which concatenates the user input into a command and runs it on the server, leading to arbitrary command execution. At time of publication, no known patched versions are available.


Mitigations:

Architectural layers (MAESTRO):