So Vits Svc
Monthly
Arbitrary file read and write in SoftVC VITS Singing Voice Conversion (so-vits-svc, through commit 730930d) lets unauthenticated remote attackers exfiltrate any server-readable file and plant .wav files anywhere the process can write, by supplying attacker-controlled paths in the audio_path field of the /wav2wav Flask route. Because the full-song inference server passes the value verbatim to librosa/torchaudio/soundfile sinks, a single POST can both leak file contents in the HTTP response and drop files on disk. Publicly available exploit code exists (VulnCheck advisory and geo-chen writeup); no public evidence of active exploitation at time of analysis.
Arbitrary file read and write in SoftVC VITS Singing Voice Conversion (so-vits-svc, through commit 730930d) lets unauthenticated remote attackers exfiltrate any server-readable file and plant .wav files anywhere the process can write, by supplying attacker-controlled paths in the audio_path field of the /wav2wav Flask route. Because the full-song inference server passes the value verbatim to librosa/torchaudio/soundfile sinks, a single POST can both leak file contents in the HTTP response and drop files on disk. Publicly available exploit code exists (VulnCheck advisory and geo-chen writeup); no public evidence of active exploitation at time of analysis.