CVE-2025-49833: GPT-SoVITS-WebUI RCE Vulnerability

CVE-2025-49833 Overview

CVE-2025-49833 is a command injection vulnerability affecting GPT-SoVITS-WebUI, a popular voice conversion and text-to-speech web interface. The vulnerability exists in the open_slice function within webui.py, where user-supplied input through slice_opt_root and slice-inp-path parameters is concatenated directly into a system command without proper sanitization. This allows remote attackers to execute arbitrary commands on the server hosting the application.

Critical Impact

Unauthenticated attackers can achieve arbitrary command execution on the server by injecting malicious payloads through the web interface input fields, potentially leading to complete system compromise.

Affected Products

• GPT-SoVITS-WebUI version 20250228v3 and prior
• rvc-boss gpt-sovits-webui (all versions up to and including 20250228v3)

Discovery Timeline

• 2025-07-15 - CVE CVE-2025-49833 published to NVD
• 2025-07-30 - Last updated in NVD database

Technical Details for CVE-2025-49833

Vulnerability Analysis

This command injection vulnerability (CWE-77) stems from improper handling of user-controlled input in the GPT-SoVITS-WebUI application. The open_slice function in webui.py accepts user input through two parameters: slice_opt_root and slice-inp-path. These values are directly concatenated into a shell command string that is subsequently executed on the server without any input validation or sanitization.

The vulnerability is particularly dangerous because it requires no authentication and can be exploited over the network. An attacker can craft malicious input containing shell metacharacters or command separators to break out of the intended command context and inject arbitrary commands that execute with the privileges of the web application process.

At the time of publication, no patched versions are available from the vendor, leaving all deployments of version 20250228v3 and earlier exposed to this attack.

Root Cause

The root cause of CVE-2025-49833 is the lack of input sanitization in the open_slice function. User-supplied values from slice_opt_root and slice-inp-path are directly incorporated into command strings using string concatenation rather than using safe APIs or parameterized command execution. This design flaw allows shell metacharacters in user input to be interpreted by the underlying shell, enabling command injection attacks.

Attack Vector

The attack vector is network-based, requiring no authentication or user interaction. An attacker can submit crafted input through the web interface that includes shell command separators (such as ;, &&, ||, or backticks) followed by malicious commands. When the open_slice function processes this input, the injected commands are executed on the server.

The vulnerable code paths can be found in multiple locations within the webui.py file, as documented in the GitHub Security Advisory.

Detection Methods for CVE-2025-49833

Indicators of Compromise

• Unexpected process spawning from the GPT-SoVITS-WebUI application process
• Unusual outbound network connections originating from the web server
• Log entries containing shell metacharacters (;, &&, ||, backticks, $()) in slice_opt_root or slice-inp-path parameters
• Creation of unauthorized files or modification of system configurations
• Evidence of reverse shell connections or data exfiltration attempts

Detection Strategies

• Implement web application firewall (WAF) rules to detect command injection patterns in HTTP request parameters
• Monitor application logs for suspicious input patterns containing shell metacharacters
• Deploy endpoint detection and response (EDR) solutions to identify anomalous child process creation from the web application
• Use network monitoring to detect unusual outbound connections from servers running GPT-SoVITS-WebUI

Monitoring Recommendations

• Enable detailed logging for the GPT-SoVITS-WebUI application and monitor for injection attempts
• Configure alerts for process execution anomalies on systems hosting the vulnerable application
• Monitor file system integrity on web servers to detect unauthorized modifications
• Implement network segmentation and monitor for lateral movement attempts from compromised hosts

How to Mitigate CVE-2025-49833

Immediate Actions Required

• Restrict network access to GPT-SoVITS-WebUI deployments to trusted IP addresses only
• Place the application behind a reverse proxy with strict input validation rules
• Consider disabling or removing the vulnerable functionality until a patch is available
• Implement additional network segmentation to limit the impact of potential compromise
• Run the application with minimal system privileges to reduce the blast radius of successful exploitation

Patch Information

At the time of publication, no known patched versions are available from the vendor. Organizations using GPT-SoVITS-WebUI should monitor the GitHub Security Advisory for updates on patch availability. The vulnerability affects version 20250228v3 and all prior versions.

Workarounds

• Implement a web application firewall (WAF) with rules blocking command injection patterns in the slice_opt_root and slice-inp-path parameters
• Restrict access to the web interface using network-level controls such as firewall rules or VPN requirements
• Run the application in an isolated container or virtual machine environment to limit potential damage
• Disable the slice functionality if it is not essential to your deployment

# Example: Restrict access to GPT-SoVITS-WebUI using iptables
# Allow only trusted IP addresses to access the web interface
iptables -A INPUT -p tcp --dport 7865 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p tcp --dport 7865 -j DROP