RVC-Boss - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/vendors/rvc-boss/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioMon, 20 Jul 2026 20:18:01 +0000CVE-2026-63766: Unauthenticated OS Command Injection in GPT-SoVITS webui.pyhttps://feed.craftedsignal.io/briefs/2026-07-gpt-sovits-os-command-injection/Mon, 20 Jul 2026 20:18:01 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-07-gpt-sovits-os-command-injection/An unauthenticated OS command injection vulnerability (CVE-2026-63766) in GPT-SoVITS through version 20250606v2pro's webui.py allows attackers to execute arbitrary operating system commands via shell metacharacters in Gradio textbox inputs, leading to remote code execution.GPT-SoVITS, a platform for text-to-speech and voice cloning, is affected by a critical OS command injection vulnerability, CVE-2026-63766, impacting versions through 20250606v2pro. This flaw resides in the webui.py component, specifically within the ASR, slice, denoise, and uvr5 functions. These functions insecurely interpolate unsanitized Gradio textbox values directly into shell commands executed with shell=True. An unauthenticated attacker can exploit this by injecting shell metacharacters (e.g., semicolons, pipes, ampersands) through path parameters in HTTP requests. Successful exploitation grants the attacker arbitrary OS command execution privileges, running commands as the user associated with the GPT-SoVITS server process, potentially leading to full system compromise. The vulnerability has a CVSS v3.1 base score of 9.8, indicating a critical severity and ease of exploitation.

Attack Chain

  1. An unauthenticated attacker sends a specially crafted HTTP request to the vulnerable GPT-SoVITS web interface.
  2. The request targets a susceptible function within webui.py, such as ASR, slice, denoise, or uvr5.
  3. The attacker injects shell metacharacters (e.g., ;, |, &&, $()) into a path parameter or Gradio textbox input that is not properly sanitized.
  4. The vulnerable Python code in webui.py interpolates the unsanitized malicious input directly into a system command executed using a shell (e.g., subprocess.run(..., shell=True)).
  5. The operating system's shell processes the combined command string, interpreting the injected metacharacters as distinct commands.
  6. The attacker's arbitrary commands are executed on the server, typically with the privileges of the GPT-SoVITS application user.
  7. The attacker gains remote code execution, potentially enabling persistent access, data exfiltration, or further lateral movement within the network.

Impact

Successful exploitation of CVE-2026-63766 results in unauthenticated remote code execution (RCE) on the server hosting GPT-SoVITS. Given the CVSS v3.1 score of 9.8 (Critical), this vulnerability allows for complete compromise of confidentiality, integrity, and availability of the affected system. Attackers can execute any command with the privileges of the server process, enabling them to install backdoors, steal sensitive data, modify system configurations, or deploy further malicious payloads. Organizations using GPT-SoVITS for AI/ML model inference or development could face significant data breaches, operational disruption, and reputational damage.

Recommendation

  • Patch GPT-SoVITS to a version beyond 20250606v2pro to remediate CVE-2026-63766 immediately.
  • Deploy the provided Sigma rule to your SIEM to detect exploitation attempts targeting webui.py with shell metacharacters.
  • Monitor web server access logs and application logs for unusual HTTP requests to webui.py or unexpected command execution originating from the GPT-SoVITS process.
  • Implement strong input validation for all user-supplied data, especially in web applications, to prevent similar command injection vulnerabilities.
]]>criticaladvisorycommand-injectionrceweb-vulnerabilityai/ml-modelcve