See how gpt-sovits compares to other vendors in security performance
GPT-SoVITS through 20250606v2pro contains an OS command injection vulnerability in tools/uvr5/vr.py that allows unauthenticated attackers to execute commands via output folder paths. Attackers can enter shell substitutions like $(...) in the UVR5 WebUI output folder textboxes with mp3 or m4a export to run commands as the server user.
GPT-SoVITS through 20250606v2pro contains an OS command injection vulnerability in webui.py where ASR, slice, denoise, and uvr5 functions interpolate unsanitized Gradio textbox values directly into shell commands executed with shell=True. Attackers can inject shell metacharacters through path parameters to execute arbitrary OS commands as the server process user without authentication.
GPT-SoVITS is vulnerable to multiple command injections.
GPT-SoVITS is vulnerable to multiple command injections.
GPT-SoVITS is vulnerable to multiple command injections.
GPT-SoVITS is vulnerable to multiple command injections.
GPT-SoVITS is vulnerable to multiple unsafe deserializations, which lead to remote code execution.
GPT-SoVITS is vulnerable to multiple unsafe deserializations, which lead to remote code execution.
GPT-SoVITS is vulnerable to multiple unsafe deserializations, which lead to remote code execution.
GPT-SoVITS is vulnerable to multiple unsafe deserializations, which lead to remote code execution.
GPT-SoVITS is vulnerable to multiple unsafe deserializations, which lead to remote code execution.