CVE-2026-63766 GPT-SoVITS 20250606v2pro OS Command Injection via webui.py

GPT-SoVITS through 20250606v2pro contains an OS command injection vulnerability in webui.py where ASR, slice, denoise, and uvr5 functions interpolate unsanitized Gradio textbox values directly into shell commands executed with shell=True. Attackers can inject shell metacharacters through path...

PT-2026-61705

Name of the Vulnerable Software and Affected Versions GPT-SoVITS versions prior to 20250606v2pro Description An OS command injection flaw exists in webui.py where the ASR, slice, denoise, and uvr5 functions interpolate unsanitized Gradio textbox values directly into shell commands executed with...