CVE-2025-49841highCWE-502

CVE-2025-49841: falha de alta gravidade em RVC-Boss GPT-SoVITS

GHSL-2025-053: GPT-SoVITS Deserialization of Untrusted Data vulnerability

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar GPT-SoVITS

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 8.9epss 0.8%
GPT-SoVITS-WebUI is a voice conversion and text-to-speech webUI. In versions 20250228v3 and prior, there is an unsafe deserialization vulnerability in process_ckpt.py. The SoVITS_dropdown variable takes user input and passes it to the load_sovits_new function in process_ckpt.py. In load_sovits_new, the user input, here sovits_path is used to load a model with torch.load, leading to unsafe deserialization. At time of publication, no known patched versions are available.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
Produtos afetados
RVC-Boss · GPT-SoVITS
CVEs relacionadas — RVC-Boss GPT-SoVITS

No mesmo produto, das mais perigosas para as menos.

CVE-2025-49835HIGHGHSL-2025-047: GPT-SoVITS Command Injection vulnerabilityEPSS 3.3%CVE-2025-49833HIGHGHSL-2025-045: GPT-SoVITS Command Injection vulnerabilityEPSS 3.3%CVE-2025-49836HIGHGHSL-2025-048: GPT-SoVITS Command Injection vulnerabilityEPSS 3.3%CVE-2025-49834HIGHGHSL-2025-046: GPT-SoVITS Command Injection vulnerabilityEPSS 3.3%CVE-2025-71429CRITICALGPT-SoVITS through 20250606v2pro OS Command Injection via UVR5 vr.pyEPSS 2.9%CVE-2026-63766CRITICALGPT-SoVITS 20250606v2pro OS Command Injection via webui.pyEPSS 2.1%