CVE-2026-63766: GPT-SoVITS 20250606v2pro OS Command Injection via webui.py
GPT-SoVITS through 20250606v2pro contains an OS command injection vulnerability in webui.py where ASR, slice, denoise, and uvr5 functions interpolate unsanitized Gradio textbox values directly into shell commands executed with shell=True. Attackers can inject shell metacharacters through path parameters to execute arbitrary OS commands as the server process user without authentication.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-63766?
CVE-2026-63766 has a critical severity score of 9.8.
How do I fix CVE-2026-63766?
To fix CVE-2026-63766, update to the latest version of GPT-SoVITS where the OS command injection vulnerability is patched.
What is the impact of CVE-2026-63766?
The impact of CVE-2026-63766 allows attackers to execute arbitrary OS commands on the affected system due to unsanitized input.
Which functions are affected by CVE-2026-63766?
The functions ASR, slice, denoise, and uvr5 in GPT-SoVITS are affected by CVE-2026-63766.
What type of vulnerability is CVE-2026-63766?
CVE-2026-63766 is classified as an OS command injection vulnerability.