CVE-2024-39686

CVE-2024-39686 affects fishaudio/Bert-VITS2 (VITS2 Backbone with multilingual BERT). The root cause is that user input provided to the data_dir variable is used directly in a shell command via subprocess.run(cmd, shell=True) inside the bert_gen function, allowing arbitrary command execution. Affe...