CVE-2025-49833: GHSL-2025-045_GHSL-2025-048: Command injection in GPT-SoVITS - CVE-2025-49833, CVE-2025-49834, CVE-2025-49835, CVE-2025-49836
GPT-SoVITS is vulnerable to multiple command injections.
Other sources
GPT-SoVITS-WebUI is a voice conversion and text-to-speech webUI. In versions 20250228v3 and prior, there is a command injection vulnerability in the webui.py openslice function. sliceoptroot and slice-inp-path takes user input, which is passed to the openslice function, which concatenates the user input into a command and runs it on the server, leading to arbitrary command execution. At time of publication, no known patched versions are available.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-49833?
CVE-2025-49833 is classified as a medium severity vulnerability due to its command injection potential.
How do I fix CVE-2025-49833?
To fix CVE-2025-49833, update GPT-SoVITS-WebUI to version 20250301 or later.
What versions of GPT-SoVITS-WebUI are affected by CVE-2025-49833?
CVE-2025-49833 affects versions of GPT-SoVITS-WebUI up to and including 20250228v3.
What type of vulnerability is CVE-2025-49833?
CVE-2025-49833 is a command injection vulnerability found in the open_slice function.
Who is the vendor for the software affected by CVE-2025-49833?
The vendor for the affected software is GPT-SoVITS.