All vulnerabilities
CVE-2025-71429

GPT-SoVITS through 20250606v2pro OS Command Injection via UVR5 vr.py

RVC-Boss GPT-SoVITS
Open in ThreatlineRecord JSON
CVSS
9.3Critical
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)2.87%Chance of exploitation activity in the next 30 days, higher than 86% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed inNone listedNo source names a fixed version. Check the vendor advisory below
Published12 Oct 2026Updated 13 Oct 2026CVE List

What fixes it

No source in this snapshot names a fixed version. The vendor advisories under References are the place to check.

Description

GPT-SoVITS through 20250606v2pro contains an OS command injection vulnerability in tools/uvr5/vr.py that allows unauthenticated attackers to execute commands via output folder paths. Attackers can enter shell substitutions like $(...) in the UVR5 WebUI output folder textboxes with mp3 or m4a export to run commands as the server user.

Text from CVE List

Affected versions 1

  • GPT-SoVITSaffected: all versions through 20250606v2proCVE List

References 4