External risk intelligence

GPT-SoVITS OS Command Injection via UVR5 WebUI Output Path

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2025-71429

The vulnerability exists in a WebUI component of a specialized machine learning tool (GPT-SoVITS). While it features a web interface that could be exposed, these tools are typically deployed for local use, development, or internal research rather than as public-facing production internet services. Public internet exposure is plausible in some research environments, but it is not a standard design pattern.

OS Command Injection

Halo Surface Signal: 3 out of 5 — possibly public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This vulnerability impacts GPT-SoVITS software, specifically within its audio processing tools, allowing unauthenticated attackers to execute arbitrary commands on the server by manipulating output folder paths. This could potentially lead to a compromise of the server where the software is running.

Attackers can run commands through output folder paths.
This enables unauthorized server command execution.
Confirm if this specialized tool is exposed externally.

Attack Path

How an attacker could exploit the issue

An unauthenticated attacker can reach the vulnerable component by accessing the GPT-SoVITS WebUI. The attacker can then submit specially crafted output folder paths containing shell substitutions to the UVR5 tool. Successful injection allows the attacker to execute arbitrary commands on the server with the privileges of the running application user.

No authentication required.
Output folder path with shell substitutions.
Arbitrary command execution as server user.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability allows unauthenticated attackers to execute arbitrary commands on the server by providing specially crafted output folder paths within the UVR5 WebUI. When exporting audio files (mp3 or m4a), these paths can contain shell substitutions that are interpreted by the operating system, leading to command execution as the server user.

Server user commands could be executed.
Via malicious output folder paths.
Compromise of server resources.

Operational Fix

Recommended remediation, mitigation, and detection steps

The primary responsibility for addressing this command injection vulnerability likely falls to the platform or infrastructure team managing the GPT-SoVITS deployment, in coordination with the application owners who use or manage the UVR5 WebUI. The immediate first step should be to locate all instances of the affected technology, determine their exposure and criticality, and identify the specific teams or individuals accountable for each instance. A risk-based remediation plan can then be developed, which may involve vendor coordination or temporary mitigation strategies if immediate patching is not feasible.

Platform and application teams own resolution.
Verify UVR5 WebUI exposure and output paths.
Plan remediation based on identified risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is GPT-SoVITS?

GPT-SoVITS is an open-source tool for voice conversion and text-to-speech synthesis. It includes specialized utilities like UVR5, which processes audio separation. Users typically deploy this software to train voice models or manipulate audio files in research, creative, or development environments.

What does CVE-2025-71429 mean for the software?

This vulnerability is an OS command injection, classified as CWE-78. It means the application fails to properly sanitize user-provided input before using it in a system command. By entering specific patterns into the UVR5 WebUI, an attacker can trick the server into running unintended commands with the same permissions as the application itself.

How do attackers trigger this command injection?

An attacker triggers the bug by entering a path containing shell substitutions, such as $(...), into the output folder field in the UVR5 WebUI. This occurs when exporting audio files like mp3 or m4a. Simply visiting the page or using the interface with legitimate, non-malicious folder paths does not trigger the vulnerability.

Is my deployment at risk from this CVE?

Halo Surface Signal indicates that while this tool has a web interface, it is usually meant for internal research or local use. If your instance is only reachable from your local network, the risk is lower. However, if the WebUI is exposed to the public internet, it faces a higher likelihood of being targeted by unauthenticated attackers.

What should I do if I run GPT-SoVITS?

First, identify all instances of GPT-SoVITS in your environment to understand their network reachability. If you find instances exposed to the internet, restrict access immediately. Coordinate with your technical teams to verify the current software version and monitor project updates for official fixes, as addressing command injection requires proper input handling in the source code.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.