CVE-2025-71429: GPT-SoVITS Output Path OS Command Injection

Overview

A critical OS command injection vulnerability has been disclosed in GPT-SoVITS, a popular open-source AI voice cloning and text-to-speech (TTS) project. Tracked as CVE-2025-71429, the flaw sits in tools/uvr5/vr.py, the vocal-separation module exposed through the project's UVR5 WebUI. Output-folder path values supplied by the user are passed unsanitized into a shell command, letting an unauthenticated attacker inject arbitrary operating system commands.

The issue was reported via a GitHub issue against the RVC-Boss/GPT-SoVITS repository and was assigned a CVE by VulnCheck, with publication occurring around October 12, 2026. As of publication, no fixed release has been reported.

Technical Details

How It Works

The UVR5 WebUI bundled with GPT-SoVITS lets users separate vocals from audio tracks and export the result to a chosen output folder. The handler in tools/uvr5/vr.py builds a shell command using the output-folder path and export format supplied directly from the WebUI form, without validating or escaping shell metacharacters first.

By entering shell substitution syntax — for example $(...) — into the output-folder textbox and selecting an mp3 or m4a export, an attacker causes the resulting command string to be expanded and executed by the shell when the export runs. No login, API key, or prior session is required: anyone who can reach the WebUI's HTTP endpoint can trigger the injection. Because the attack vector is network-based with low complexity and no privileges or user interaction needed beyond submitting the form, exploitation is considered trivial for any exposed instance.

Affected and Fixed Versions

Note: No official patched release has been published yet. Treat any internet- or LAN-exposed UVR5 WebUI instance as vulnerable until the maintainers ship a fix.

Impact Assessment

Successful exploitation yields arbitrary command execution with the privileges of the process running the WebUI — commonly a developer workstation, a shared GPU inference box, or a self-hosted demo server. CVSS 4.0 metrics rate confidentiality, integrity, and availability impact as High across the board.

Who Is At Risk

• Self-hosted GPT-SoVITS deployments that expose the UVR5 WebUI on a LAN or over the internet for convenience or team access
• Demo/community instances shared publicly (e.g., for voice-cloning showcases or research)
• Any GPU host running GPT-SoVITS where the WebUI process has access to credentials, model weights, or an internal network segment

Potential Attack Chains

1. Discover the WebUI — Attacker locates an internet- or LAN-reachable GPT-SoVITS UVR5 interface (default Gradio-style ports are commonly scanned for)
2. Inject via Output Path — A crafted $(...) shell substitution is entered in the output-folder field alongside an mp3/m4a export
3. Command Execution — The export action runs the shell command, executing attacker-controlled code as the WebUI's server user
4. Lateral Movement / Data Theft — With shell access, an attacker can exfiltrate model weights or voice samples, pivot to other hosts on the network, or install persistence (e.g., a reverse shell or cron job)

Mitigation

Immediate Actions

• Do not expose the UVR5 WebUI to the internet. Bind it to localhost or a trusted internal interface only.
• Restrict network access to the WebUI port via firewall rules or a reverse proxy requiring authentication, until an upstream fix is available.
• Avoid processing untrusted output-folder input — if the WebUI must stay reachable by multiple users, front it with an authenticating proxy (e.g., Authelia, Authentik, or a VPN) rather than relying on the app's own access control, since none exists for this endpoint.
• Monitor the upstream repository (RVC-Boss/GPT-SoVITS) for a patched release and apply it as soon as it ships.

Detection Opportunities

• Review process-execution logs on hosts running GPT-SoVITS for unexpected child processes spawned by the Python WebUI process (sh, bash, curl, wget, nc, etc.)
• Flag output-folder or export-related form submissions containing shell metacharacters (`, ;, |, &, $()
• Watch for unexpected outbound connections or newly created files/cron entries originating from the GPU/inference host

Defence-in-Depth

• Run AI/ML inference tooling such as GPT-SoVITS in an isolated container or VM with minimal network reachability and no access to sensitive credentials
• Apply least-privilege service accounts to any process that exposes a web interface, so a command-injection bug cannot escalate beyond the sandbox
• Maintain an inventory of self-hosted AI tooling exposed on internal networks — these projects move fast and often ship WebUIs with limited security hardening

Background

GPT-SoVITS is a widely used open-source few-shot voice cloning and TTS framework that bundles several auxiliary tools, including the UVR5 (Ultimate Vocal Remover) WebUI for separating vocals from background audio prior to training or inference. Like many rapidly-developed AI tooling projects, its WebUIs were built for convenience on trusted local setups rather than hostile multi-tenant or internet-facing use — a pattern that has produced similar unauthenticated command- and path-injection findings across other self-hosted AI demo interfaces. Operators who moved these tools onto shared infrastructure without adding an authentication layer are the most exposed.

References

• NVD — CVE-2025-71429
• Strix AI — CVE-2025-71429: GPT-SoVITS OS Command Injection (CVSS 9.8)
• The Hacker Wire — CVE-2025-71429: GPT-SoVITS OS Command Injection: Unauthenticated Remote Code Execution via UVR5 WebUI
• OffSeq Radar — CVE-2025-71429: Improper Neutralization of Special Elements Used in an OS Command
• GitHub — RVC-Boss/GPT-SoVITS Issue #2319