Key points
- CVE-2025-71429 affects GPT-SoVITS versions up to 20250606v2pro with a CVSS score of 9.3.
- The flaw allows unauthenticated users to execute operating system commands via the UVR5 WebUI.
- Input fields for output folder paths fail to sanitize shell substitution characters like dollar signs and parentheses.
The open-source voice cloning software GPT-SoVITS contains a severe security flaw that allows attackers to execute commands on the server. According to the National Vulnerability Database, this issue, tracked as CVE-2025-71429, affects all versions through 20250606v2pro. The vulnerability exists within the UVR5 module, specifically in the file tools/uvr5/vr.py, where user input is processed insecurely.
By the numbers
- CVSS 9.3: The severity rating assigned by the NVD, indicating a critical risk level.
- CWE-78: The Common Weakness Enumeration identifier for improper neutralization of special elements used in an OS command.
- 20250606v2pro: The latest version of GPT-SoVITS confirmed to be affected by this command injection flaw.
What the figures mean
A CVSS score of 9.3 indicates a critical severity rating for the vulnerability. The CWE-78 classification confirms that the root cause is a classic command injection error, where the application passes user-controlled data directly to a system shell. The source material states that unauthenticated attackers can execute commands via output folder paths.
The attack vector relies on how the UVR5 WebUI handles output folder paths. When users select mp3 or m4a export options, they can input malicious strings into the textboxes. By entering shell substitutions such as $(...), the application executes these commands as the server user. This means an attacker can run arbitrary operating system commands on the machine hosting the GPT-SoVITS instance.
This type of flaw is particularly dangerous in tools that process media files, as users often expect the software to handle file paths safely. The ability to run commands as the server user grants the attacker the same permissions as the application itself. If the service runs with elevated privileges, the compromise could extend to other parts of the system.
What to watch
Security teams should monitor for unauthorized processes running on servers that host GPT-SoVITS. Since the exploit requires no authentication, any exposed instance is at risk from automated scanning tools looking for this specific CVE. Administrators should check if their installations are running versions up to 20250606v2pro, as these are confirmed vulnerable.
No fix has been confirmed yet. Users should assume that any version prior to a future secure release remains exposed. The lack of a fix means that exposure reduction is the primary defense strategy until the vendor provides an update.
What to do and how to stay safe: GPT-SoVITS
- Restrict network access to the GPT-SoVITS WebUI so that only trusted internal IPs can reach the service.
- Monitor server logs for unexpected command executions or new processes spawned by the UVR5 module.
- Isolate vulnerable instances from critical data until a secure version of the software is available.
- Review firewall rules to block external traffic to ports used by the GPT-SoVITS application.
Step-by-step guide: Patch Management Implementation: A Step-by-Step Rollout Plan
General security guidance from the Sandbox Gazette newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which versions of GPT-SoVITS are affected by CVE-2025-71429?
All versions of GPT-SoVITS up to and including 20250606v2pro are affected by this vulnerability.
What is the severity rating of this command injection flaw?
The National Vulnerability Database rates CVE-2025-71429 as critical with a CVSS score of 9.3.
How do attackers exploit this vulnerability?
Attackers enter shell substitutions like $(...) into the UVR5 WebUI output folder textboxes to execute commands.
