Vendor
GPT-SoVITS through 20250606v2pro is vulnerable to unauthenticated OS command injection via the UVR5 WebUI, allowing attackers to execute arbitrary commands by injecting shell metacharacters into output path parameters.