CVE-2025-71429GPT-SoVITS through 20250606v2pro OS Command Injection via UVR5 vr.py
Updated under an hour ago ()
Does this affect you?
It affects RVC-Boss GPT-SoVITS. Add what you run to find out whether that includes you.
EPSS puts the chance of exploitation in the next 30 days at 2.87%, higher than 87% of scored CVEs.
Do this next
Free account, 1 product
GPT-SoVITS through 20250606v2pro contains an OS command injection vulnerability in tools/uvr5/vr.py that allows unauthenticated attackers to execute commands via output folder paths. Attackers can enter shell substitutions like $(...) in the UVR5 WebUI output folder textboxes with mp3 or m4a export to run commands as the server user.
- CVSS
- 9.8 CRITICAL (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- CWE-78
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- 2.87% (percentile 87)
- Assigned by
- VulnCheck
- NVD analysis
- Deferred
- Record last updated
- Oct 13, 2026
- First seen by InfoSec Signals
- Oct 12, 2026
Affected products
RVC-Boss GPT-SoVITS rvc_boss:gpt_sovits (from the name) | through 20250606v2pro | CNA record |
References
- https://github.com/RVC-Boss/GPT-SoVITS/issues/2319issue-tracking
- https://github.com/RVC-Boss/GPT-SoVITS/blob/d7c2210da8c013e81a94bfc7b811a477c99fd506/tools/uvr5/vr.py#L143technical-description
- https://github.com/RVC-Boss/GPT-SoVITSproduct
- https://www.vulncheck.com/advisories/gpt-sovits-through-20250606v2pro-os-command-injection-via-uvr5-vr-pythird-party-advisory
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.