PT-2025-29683 · Unknown · Gpt-Sovits-Webui

Sylwia Budzynska + 1 · Published 2025-07-15 · Updated 2025-07-16 · CVE-2025-49841

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions GPT-SoVITS-WebUI versions 20250228v3 and prior

Description GPT-SoVITS-WebUI is a voice conversion and text-to-speech webUI. A flaw exists in process ckpt.py due to unsafe deserialization. The SoVITS dropdown variable accepts user input, which is then passed to the load sovits new function within process ckpt.py. The sovits path input is used with torch.load to load a model, resulting in unsafe deserialization.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2025-49841

Affected Products

Gpt-Sovits-Webui

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/49xxx/CVE-2025-49841.json · Exploit
• 🔥 https://securitylab.github.com/advisories/GHSL-2025-049_GHSL-2025-053_RVC-Boss_GPT-SoVITS · Exploit
• https://osv.dev/vulnerability/CVE-2025-49841 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-49841 · Security Note
• https://github.com/RVC-Boss/GPT-SoVITS/blob/165882d64f474b3563fa91adc1a679436ae9c3b8/GPT_SoVITS/process_ckpt.py#L100-L106 · Note
• https://github.com/RVC-Boss/GPT-SoVITS/blob/165882d64f474b3563fa91adc1a679436ae9c3b8/GPT_SoVITS/inference_webui.py#L926 · Note
• https://github.com/RVC-Boss/GPT-SoVITS/blob/165882d64f474b3563fa91adc1a679436ae9c3b8/GPT_SoVITS/inference_webui.py#L873 · Note
• https://t.me/cvetracker/27911 · Telegram Post
• https://twitter.com/CVEnew/status/1945226025606000908 · Twitter Post