CVE-2025-71429

Summary

GPT-SoVITS contains an OS command injection vulnerability in its UVR5 module that allows unauthenticated attackers to execute arbitrary commands as the server user by manipulating output folder paths during audio export operations.

Exploitability

The vulnerability is highly exploitable with no authentication required, allowing attackers to inject shell commands through the WebUI's output folder textboxes when exporting audio files in mp3 or m4a formats.

Blast radius

If exploited, this vulnerability could allow attackers to execute arbitrary commands on the server with the privileges of the running service, potentially leading to full system compromise and data exfiltration.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Disable the UVR5 WebUI export functionality or restrict access to the affected endpoints until a patch is available.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.