CVE-2025-49840: GHSL-2025-049_GHSL-2025-053: Remote Code Execution (RCE) in GPT-SoVITS - CVE-2025-49837, CVE-2025-49838, CVE-2025-49839, CVE-2025-49840, CVE-2025-49841
GPT-SoVITS is vulnerable to multiple unsafe deserializations, which lead to remote code execution.
Other sources
GPT-SoVITS-WebUI is a voice conversion and text-to-speech webUI. In versions 20250228v3 and prior, there is an unsafe deserialization vulnerability in inferencewebui.py. The GPTdropdown variable takes user input and passes it to the changegptweights function. In changegptweights, the user input, here gptpath is used to load a model with torch.load, leading to unsafe deserialization. At time of publication, no known patched versions are available.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-49840?
CVE-2025-49840 has been classified with a severity that highlights a serious risk due to unsafe deserialization.
How do I fix CVE-2025-49840?
To address CVE-2025-49840, users should upgrade to versions later than 20250228v3 to eliminate the unsafe deserialization vulnerability.
What software is affected by CVE-2025-49840?
CVE-2025-49840 affects the GPT-SoVITS-WebUI version 20250228v3 and earlier.
What is the main issue with CVE-2025-49840?
The main issue with CVE-2025-49840 is an unsafe deserialization vulnerability in the inference_webui.py file.
When was CVE-2025-49840 published?
CVE-2025-49840 was published in 2025 and pertains to specific versions of the GPT-SoVITS-WebUI.