CVE-2026-63766

creationtimestamp| type| source ---|---|--- 2026-07-20 20:48:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mr464y2n462a 2026-07-20 22:02:14+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mr4cbkj3xu2w 2026-07-23 13:00:04+00:00| seen|...

CVE-2026-63766

GPT-SoVITS up to 20250606v2pro is vulnerable to OS command injection in webui.py. The ASR, slice, denoise and uvr5 functions interpolate unsanitized Gradio textbox values directly into shell commands executed with shell=True, allowing attackers to inject shell metacharacters via path parameters t...

CVE-2026-63766 GPT-SoVITS 20250606v2pro OS Command Injection via webui.py

GPT-SoVITS through 20250606v2pro contains an OS command injection vulnerability in webui.py where ASR, slice, denoise, and uvr5 functions interpolate unsanitized Gradio textbox values directly into shell commands executed with shell=True. Attackers can inject shell metacharacters through path...