CVE Feed

    Dashboard / CVE / CVE-2026-63766

    CVE-2026-63766

    GPT-SoVITS through 20250606v2pro contains an OS command injection vulnerability in webui.py where ASR, slice, denoise, and uvr5 functions interpolate unsanitized Gradio textbox values directly into shell commands executed with shell=True. Attackers can inject shell metacharacters through path parameters to execute arbitrary OS commands as the server process user without authentication.

    Published:Jul 20, 2026
    Last Modified:Jul 28, 2026
    EPS:Jul 20, 2026
    EPSS Score:0.01749
    CVSS Score:9.8

    Affected Products

    Vendor
    Rvc-boss
    Product
    Gpt-sovits-webui

    Exploits

    https://github.com/0xdak/CVE-2026-63766_exploit

    Related CVEs

    CVE-2025-49841 (CVSS 8.9) — GPT-SoVITS-WebUI is a voice conversion and text-to-speech webUI. In versions 20250228v3 and prior, there is an…
    CVE-2025-49840 (CVSS 8.9) — GPT-SoVITS-WebUI is a voice conversion and text-to-speech webUI. In versions 20250228v3 and prior, there is an…
    CVE-2025-49839 (CVSS 8.9) — GPT-SoVITS-WebUI is a voice conversion and text-to-speech webUI. In versions 20250228v3 and prior, there is an…
    CVE-2025-49838 (CVSS 8.9) — GPT-SoVITS-WebUI is a voice conversion and text-to-speech webUI. In versions 20250228v3 and prior, there is an…
    CVE-2025-49837 (CVSS 8.9) — GPT-SoVITS-WebUI is a voice conversion and text-to-speech webUI. In versions 20250228v3 and prior, there is an…
    CVE-2025-49836 (CVSS 8.9) — GPT-SoVITS-WebUI is a voice conversion and text-to-speech webUI. In versions 20250228v3 and prior, there is a …
    CVE-2025-49835 (CVSS 8.9) — GPT-SoVITS-WebUI is a voice conversion and text-to-speech webUI. In versions 20250228v3 and prior, there is a …
    CVE-2025-49834 (CVSS 8.9) — GPT-SoVITS-WebUI is a voice conversion and text-to-speech webUI. In versions 20250228v3 and prior, there is a …
    CVE-2025-49833 (CVSS 8.9) — GPT-SoVITS-WebUI is a voice conversion and text-to-speech webUI. In versions 20250228v3 and prior, there is a …

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High