CVE-2025-71429

Name of the Vulnerable Software and Affected Versions GPT-SoVITS versions prior to 20250606v2pro

Description An OS command injection flaw exists in the tools/uvr5/vr.py file. Unauthenticated attackers can execute arbitrary commands with the privileges of the server user by entering shell substitutions, such as $(...), into the output folder textboxes of the UVR5 WebUI when exporting to mp3 or m4a formats.

Recommendations Restrict access to the WebUI to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.