CVE-2025-49834: GHSL-2025-045_GHSL-2025-048: Command injection in GPT-SoVITS - CVE-2025-49833, CVE-2025-49834, CVE-2025-49835, CVE-2025-49836
GPT-SoVITS is vulnerable to multiple command injections.
Other sources
GPT-SoVITS-WebUI is a voice conversion and text-to-speech webUI. In versions 20250228v3 and prior, there is a command injection vulnerability in webui.py opendenoise function. denoiseinpdir and denoiseoptdir take user input, which is passed to the opendenoise function, which concatenates the user input into a command and runs it on the server, leading to arbitrary command execution. At time of publication, no known patched versions are available.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-49834?
CVE-2025-49834 has a medium severity rating due to the command injection vulnerability it presents.
How do I fix CVE-2025-49834?
To fix CVE-2025-49834, update GPT-SoVITS-WebUI to a version later than 20250228v3.
What are the main impacts of CVE-2025-49834?
The main impact of CVE-2025-49834 is that it allows an attacker to execute arbitrary commands on the server through user-supplied input.
Which versions of GPT-SoVITS-WebUI are affected by CVE-2025-49834?
Versions of GPT-SoVITS-WebUI up to and including 20250228v3 are affected by CVE-2025-49834.
What components does CVE-2025-49834 affect within GPT-SoVITS-WebUI?
CVE-2025-49834 specifically affects the open_denoise function in the webui.py file.