GPT-SoVITS UVR5 Module Exposes Critical OS Command Injection Flaw
Unauthenticated users can execute server commands via manipulated output paths in the voice cloning tool’s vocal remover interface.
Key points
- CVE-2025-71429 affects GPT-SoVITS versions up to 20250606v2pro.
- The flaw allows arbitrary code execution as the server user.
- Attackers exploit the UVR5 WebUI output folder input fields.
The National Vulnerability Database lists a critical OS command injection flaw in GPT-SoVITS. This vulnerability enables unauthenticated remote code execution through the application’s vocal removal module, posing a severe risk to server integrity.
What happened
CVE-2025-71429 is rated 9.3 on the CVSS scale, indicating a critical severity level. According to the NVD record, the vulnerability exists in GPT-SoVITS versions through 20250606v2pro, developed by RVC-Boss. The flaw resides specifically within the tools/uvr5/vr.py file, which handles operations for the UVR5 component.
Attackers can exploit this weakness without prior authentication. By entering shell substitution strings, such as $(...), into the output folder textboxes of the UVR5 WebUI, they can trigger command execution. This occurs when users attempt to export audio files in mp3 or m4a formats. The injected commands run with the privileges of the server user, allowing execution of system commands.
Why it matters
The vulnerability maps to CWE-78, which covers OS command injection issues. Because the attack vector is unauthenticated, any user with network access to the WebUI can potentially compromise the host. The ability to execute commands as the server user means an attacker could run arbitrary commands on the system.
This issue highlights risks in web interfaces that process user-supplied file paths. The UVR5 module’s handling of export destinations allows shell metacharacters to be interpreted by the operating system. Consequently, attackers can leverage the output folder textboxes to run commands as the server user, bypassing application boundaries.
Next steps
- Audit all GPT-SoVITS installations for version 20250606v2pro or earlier.
- Restrict network access to the UVR5 WebUI to trusted internal IPs only.
- Monitor server logs for unexpected shell commands or process creation.
- Isolate affected servers until a patched version is confirmed available.
What to do and how to stay safe: GPT-SoVITS
- Verify current GPT-SoVITS version against the affected list.
- Implement strict input validation on all file path fields in web applications.
- Use least-privilege service accounts for running audio processing tools.
- Segment network access to prevent external exploitation of internal tools.
Step-by-step guide: Emergency Patching: How to Fix Critical Flaws Without Breaking Production
General security guidance from the Packet Tribune newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which versions of GPT-SoVITS are affected by CVE-2025-71429?
All versions up to and including 20250606v2pro are vulnerable to this OS command injection flaw.
How can an attacker exploit this vulnerability?
Attackers enter shell substitutions like $(...) into the UVR5 WebUI output folder textboxes during mp3 or m4a exports.
Is authentication required to exploit this flaw?
No, the vulnerability allows unauthenticated attackers to execute commands on the server.
