PT-2025-29675

CVE-2025-49833

Publicado

2025-07-15

Atualizado

2025-07-16

Descrição por

CVSS 3.1

9.8

Crítica

MétricasAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions GPT-SoVITS-WebUI versions 20250228v3 and prior

Description GPT-SoVITS-WebUI is a voice conversion and text-to-speech webUI. A command injection issue exists in the webui.py open slice function. User-supplied input to slice opt root and slice-inp-path is concatenated into a command and executed on the server, potentially leading to arbitrary command execution.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Explorabilidade

Exploit

Impactos

Pesquisadores

Sylwia Budzynska

Sylwia-Budzynska

Fornecedores

Produtos afetados

Enumeração de fraquezas

CWE-77: Improper Neutralization of Special Elements used in a Command (\'Command Injection\')

Identificadores relacionados