RVC-Boss vulnerabilities
We track 11 vulnerabilities in RVC-Boss products across 2 products. 11 are rated high or critical, and none are known to be exploited. The most recent was published on October 12, 2026.
Latest RVC-Boss vulnerabilities
- 9.8 Critical severity
GPT-SoVITS: Improper Neutralization of Special Elements used in an OS Command
GPT-SoVITS through 20250606v2pro contains an OS command injection vulnerability in tools/uvr5/vr.py that allows unauthenticated attackers to execute commands via output folder paths. Attackers can enter shell substitutions like $(...) in the UVR5 WebUI output
- 9.8 Critical severity
GPT-SoVITS: Improper Neutralization of Special Elements used in an OS Command
GPT-SoVITS through 20250606v2pro contains an OS command injection vulnerability in webui.py where ASR, slice, denoise, and uvr5 functions interpolate unsanitized Gradio textbox values directly into shell commands executed with shell=True. Attackers can inject
- 9.8 Critical severity
GPT-SoVITS: Deserialization of Untrusted Data
GPT-SoVITS-WebUI is a voice conversion and text-to-speech webUI. In versions 20250228v3 and prior, there is an unsafe deserialization vulnerability in process_ckpt.py. The SoVITS_dropdown variable takes user input and passes it to the load_sovits_new function
- 9.8 Critical severity
GPT-SoVITS: Deserialization of Untrusted Data
GPT-SoVITS-WebUI is a voice conversion and text-to-speech webUI. In versions 20250228v3 and prior, there is an unsafe deserialization vulnerability in inference_webui.py. The GPT_dropdown variable takes user input and passes it to the change_gpt_weights functi
- 9.8 Critical severity
GPT-SoVITS: Deserialization of Untrusted Data
GPT-SoVITS-WebUI is a voice conversion and text-to-speech webUI. In versions 20250228v3 and prior, there is an unsafe deserialization vulnerability in bsroformer.py. The model_choose variable takes user input (e.g. a path to a model) and passes it to the uvr f
- 9.8 Critical severity
GPT-SoVITS: Deserialization of Untrusted Data
GPT-SoVITS-WebUI is a voice conversion and text-to-speech webUI. In versions 20250228v3 and prior, there is an unsafe deserialization vulnerability in vr.py AudioPreDeEcho. The model_choose variable takes user input (e.g. a path to a model) and passes it to th
- 9.8 Critical severity
GPT-SoVITS: Deserialization of Untrusted Data
GPT-SoVITS-WebUI is a voice conversion and text-to-speech webUI. In versions 20250228v3 and prior, there is an unsafe deserialization vulnerability in vr.py AudioPre. The model_choose variable takes user input (e.g. a path to a model) and passes it to the uvr
- 9.8 Critical severity
GPT-SoVITS: Improper Neutralization of Special Elements used in a Command
GPT-SoVITS-WebUI is a voice conversion and text-to-speech webUI. In versions 20250228v3 and prior, there is a command injection vulnerability in webui.py change_label function. path_list takes user input, which is passed to the change_label function, which con
- 9.8 Critical severity
GPT-SoVITS: Improper Neutralization of Special Elements used in a Command
GPT-SoVITS-WebUI is a voice conversion and text-to-speech webUI. In versions 20250228v3 and prior, there is a command injection vulnerability in webui.py open_asr function. asr_inp_dir (and a number of other variables) takes user input, which is passed to the
- 9.8 Critical severity
GPT-SoVITS: Improper Neutralization of Special Elements used in a Command
GPT-SoVITS-WebUI is a voice conversion and text-to-speech webUI. In versions 20250228v3 and prior, there is a command injection vulnerability in webui.py open_denoise function. denoise_inp_dir and denoise_opt_dir take user input, which is passed to the open_de
- 9.8 Critical severity
GPT-SoVITS: Improper Neutralization of Special Elements used in a Command
GPT-SoVITS-WebUI is a voice conversion and text-to-speech webUI. In versions 20250228v3 and prior, there is a command injection vulnerability in the webui.py open_slice function. slice_opt_root and slice-inp-path takes user input, which is passed to the open_s