CVE-2025-49835: GHSL-2025-045_GHSL-2025-048: Command injection in GPT-SoVITS - CVE-2025-49833, CVE-2025-49834, CVE-2025-49835, CVE-2025-49836
GPT-SoVITS is vulnerable to multiple command injections.
Other sources
GPT-SoVITS-WebUI is a voice conversion and text-to-speech webUI. In versions 20250228v3 and prior, there is a command injection vulnerability in webui.py openasr function. asrinpdir (and a number of other variables) takes user input, which is passed to the openasr function, which concatenates the user input into a command and runs it on the server, leading to arbitrary command execution. At time of publication, no known patched versions are available.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-49835?
CVE-2025-49835 has a high severity rating due to its command injection vulnerability.
How do I fix CVE-2025-49835?
To fix CVE-2025-49835, update your GPT-SoVITS-WebUI to version 20250301 or later.
What products are affected by CVE-2025-49835?
CVE-2025-49835 affects versions of GPT-SoVITS-WebUI up to and including 20250228v3.
What is the nature of the vulnerability in CVE-2025-49835?
CVE-2025-49835 is a command injection vulnerability found in the open_asr function of webui.py.
Who should be concerned about CVE-2025-49835?
Developers and administrators using GPT-SoVITS-WebUI should be concerned about CVE-2025-49835 and apply the necessary updates.