PT-2025-29679 · Unknown · Gpt-Sovits-Webui

Sylwia Budzynska

+1

·

Published

2025-07-15

·

Updated

2025-07-16

·

CVE-2025-49837

CVSS v3.1

9.8

Critical

VectorAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions GPT-SoVITS-WebUI versions 20250228v3 and prior
Description GPT-SoVITS-WebUI is a voice conversion and text-to-speech webUI. A flaw exists due to unsafe deserialization in the vr.py AudioPre module. The model choose variable accepts user-supplied input, including a path to a model, and passes it to the uvr function. Within uvr, an instance of the AudioPre class is created, utilizing the user-provided input as the model path attribute, with the .pth extension appended. The AudioPre class then uses this model path to load the model using torch.load, which can result in unsafe deserialization.
Recommendations Versions prior to 20250228v3 are vulnerable. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2025-49837

Affected Products

Gpt-Sovits-Webui