CVE-2025-49836: GHSL-2025-045_GHSL-2025-048: Command injection in GPT-SoVITS - CVE-2025-49833, CVE-2025-49834, CVE-2025-49835, CVE-2025-49836
GPT-SoVITS is vulnerable to multiple command injections.
Other sources
GPT-SoVITS-WebUI is a voice conversion and text-to-speech webUI. In versions 20250228v3 and prior, there is a command injection vulnerability in webui.py changelabel function. pathlist takes user input, which is passed to the changelabel function, which concatenates the user input into a command and runs it on the server, leading to arbitrary command execution. At time of publication, no known patched versions are available.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-49836?
CVE-2025-49836 is classified as a high-severity command injection vulnerability.
How do I fix CVE-2025-49836?
To fix CVE-2025-49836, upgrade to versions later than 20250228v3 of the GPT-SoVITS-WebUI.
What software is affected by CVE-2025-49836?
CVE-2025-49836 affects versions of GPT-SoVITS-WebUI up to and including 20250228v3.
What type of vulnerability is CVE-2025-49836?
CVE-2025-49836 is a command injection vulnerability that allows malicious user input.
Where in the code does CVE-2025-49836 occur?
CVE-2025-49836 occurs in the change_label function of the webui.py file.