CVE-2026-63766: GPT-SoVITS RCE Vulnerability

CVE-2026-63766 Overview

CVE-2026-63766 is an OS command injection vulnerability in GPT-SoVITS through version 20250606v2pro. The flaw resides in webui.py, where the ASR, slice, denoise, and uvr5 functions pass unsanitized Gradio textbox values directly into shell commands executed with shell=True. Unauthenticated remote attackers can inject shell metacharacters through path parameters to execute arbitrary operating system commands as the server process user. The issue is tracked under CWE-78 (Improper Neutralization of Special Elements used in an OS Command).

Critical Impact
Unauthenticated attackers can execute arbitrary OS commands as the server process user, leading to full compromise of the host running GPT-SoVITS.

Affected Products

GPT-SoVITS through version 20250606v2pro
Deployments exposing the webui.py Gradio interface
Any environment invoking the ASR, slice, denoise, or uvr5 functions

Discovery Timeline

2026-07-20 - CVE-2026-63766 published to NVD
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-63766

Vulnerability Analysis

GPT-SoVITS is an open-source voice cloning and text-to-speech framework that exposes a Gradio-based web UI. The webui.py module orchestrates several audio-processing pipelines, including automatic speech recognition (ASR), audio slicing, denoising, and vocal separation via UVR5. Each of these workflows accepts file and directory paths supplied by the user through Gradio textboxes.

The vulnerable code paths concatenate these user-controlled strings into shell command lines and execute them through Python's subprocess API with shell=True. Because no escaping or allow-listing is performed, any shell metacharacter supplied in a path field is interpreted by the shell. The service does not enforce authentication, so any network-accessible instance is exploitable.

Root Cause

The root cause is unsafe command construction. The application interpolates raw Gradio input values into shell strings and delegates parsing to /bin/sh via shell=True. This pattern violates [CWE-78] because arbitrary characters such as ;, &&, |, and backticks are treated as shell operators rather than literal path components. Combined with the absence of authentication on the web UI, the flaw grants pre-auth command execution.

Attack Vector

Exploitation requires network access to the GPT-SoVITS web UI. An attacker submits a crafted value in one of the exposed path textboxes for the ASR, slice, denoise, or uvr5 features. The injected metacharacters break out of the intended argument context and execute follow-on commands under the identity of the server process. From there, an attacker can stage payloads, pivot to internal systems, or exfiltrate model weights and training data. See the VulnCheck Security Advisory and the GitHub Issue Tracker Entry for further technical detail.

Detection Methods for CVE-2026-63766

Indicators of Compromise

Unexpected child processes spawned by the Python interpreter running webui.py, particularly shells such as sh, bash, or utilities like curl, wget, nc, and python -c.
Gradio access logs containing shell metacharacters (;, |, &&, backticks, $()) in path parameters submitted to ASR, slice, denoise, or uvr5 endpoints.
Outbound network connections from the GPT-SoVITS host to unfamiliar destinations shortly after web UI activity.

Detection Strategies

Alert on process lineage where python executing webui.py spawns interactive shells or download utilities.
Inspect HTTP request bodies to Gradio endpoints for suspicious characters in fields that are supposed to hold file paths.
Monitor for new files written to the GPT-SoVITS working directory that do not match audio artifacts (.wav, .flac).

Monitoring Recommendations

Forward Gradio and reverse-proxy access logs to a centralized logging platform and retain them for post-incident review.
Enable auditd or equivalent process-execution telemetry on hosts running the service to capture command lines with shell=True invocations.
Track egress traffic from the GPT-SoVITS host and baseline expected destinations to surface anomalous callbacks.

How to Mitigate CVE-2026-63766

Immediate Actions Required

Remove the GPT-SoVITS web UI from any untrusted network, including the public internet, until a patched build is deployed.
Place the service behind an authenticated reverse proxy that enforces strong access controls and rate limiting.
Run the service under a dedicated, unprivileged user account with no write access to sensitive directories.

Patch Information

At the time of publication, no fixed release has been enumerated in NVD for CVE-2026-63766. Track the upstream GitHub Issue Tracker Entry and the VulnCheck Security Advisory for remediation status. Upgrade to a release that removes shell=True usage and validates path inputs against an allow list.

Workarounds

Restrict inbound access to the Gradio port using host firewall rules or network segmentation so only trusted operators can reach it.
Apply local input filtering in a fork of webui.py that rejects any path parameter containing shell metacharacters before it reaches the subprocess call.
Execute the service inside a hardened container with a read-only filesystem, dropped capabilities, and a restrictive seccomp profile to limit the impact of command execution.

bash

# Configuration example: restrict Gradio exposure with a host firewall
sudo ufw default deny incoming
sudo ufw allow from 10.0.0.0/24 to any port 9874 proto tcp
sudo ufw enable

# Run GPT-SoVITS under an unprivileged user inside a hardened container
docker run --rm \
  --user 1001:1001 \
  --read-only \
  --cap-drop=ALL \
  --security-opt no-new-privileges \
  -p 127.0.0.1:9874:9874 \
  gpt-sovits:patched