Summary
GPT-SoVITS contains a critical OS command injection vulnerability in the UVR5 WebUI's output-folder handling. An unauthenticated attacker may be able to execute commands as the server user when exporting audio through supported MP3 or M4A workflows and supplying a crafted output path.
GPT-SoVITS contains a critical OS command injection vulnerability in the UVR5 WebUI's output-folder handling. An unauthenticated attacker may be able to execute commands as the server user when exporting audio through supported MP3 or M4A workflows and supplying a crafted output path.
Affected context
The vulnerability occurs in the UVR5 processing workflow when output-folder values submitted through the WebUI are incorporated into operating-system command execution. Deployments are at risk when the WebUI is reachable by untrusted users and the affected MP3 or M4A export path processes folder input without sufficiently separating data from shell syntax.
The vulnerability occurs in the UVR5 processing workflow when output-folder values submitted through the WebUI are incorporated into operating-system command execution. Deployments are at risk when the WebUI is reachable by untrusted users and the affected MP3 or M4A export path processes folder input without sufficiently separating data from shell syntax.
Exploit preconditions
- Attack surface: UVR5 WebUI output-folder input
- Required access: Network access to the WebUI; authentication may not be required
- Trigger point: MP3 or M4A export processing
- Why exploitation is possible: User-controlled path data reaches a shell command without adequate neutralization or safe argument handling
- Attack surface: UVR5 WebUI output-folder input
- Required access: Network access to the WebUI; authentication may not be required
- Trigger point: MP3 or M4A export processing
- Why exploitation is possible: User-controlled path data reaches a shell command without adequate neutralization or safe argument handling
Why this happens
The underlying bug is OS command injection, mapped to CWE-78. Application-controlled command execution incorporates attacker-influenced output-folder text as shell-interpreted input rather than treating it strictly as a filesystem path. When shell syntax is evaluated during command construction or execution, data intended to identify an output location can alter the command's behavior.
The underlying bug is OS command injection, mapped to CWE-78. Application-controlled command execution incorporates attacker-influenced output-folder text as shell-interpreted input rather than treating it strictly as a filesystem path. When shell syntax is evaluated during command construction or execution, data intended to identify an output location can alter the command's behavior.
Potential impact
- An attacker could execute arbitrary commands as the GPT-SoVITS server user
- The application environment could be modified or compromised
- Sensitive files, credentials, or generated audio data may be accessed
- The host or surrounding services could be used for further compromise
- Processing workloads and stored media could be disrupted or tampered with
- An attacker could execute arbitrary commands as the GPT-SoVITS server user
- The application environment could be modified or compromised
- Sensitive files, credentials, or generated audio data may be accessed
- The host or surrounding services could be used for further compromise
- Processing workloads and stored media could be disrupted or tampered with
General mitigation guidance
Mitigation generally focuses on removing shell interpretation from application-controlled process execution and reducing trust in WebUI input.
Common defensive patterns include:
- Use direct process APIs with argument arrays instead of shell-based command construction
- Treat output folders as validated filesystem paths, not command fragments
- Apply strict allowlists for permitted path formats and enforce safe base directories
- Reject unexpected separators, control characters, and shell metacharacters where appropriate
- Require authentication and restrict WebUI exposure to trusted networks
- Run the service with a dedicated least-privileged account and restrict filesystem access
- Apply sandboxing and resource controls to limit the effect of process compromise
Mitigation generally focuses on removing shell interpretation from application-controlled process execution and reducing trust in WebUI input.
Common defensive patterns include:
- Use direct process APIs with argument arrays instead of shell-based command construction
- Treat output folders as validated filesystem paths, not command fragments
- Apply strict allowlists for permitted path formats and enforce safe base directories
- Reject unexpected separators, control characters, and shell metacharacters where appropriate
- Require authentication and restrict WebUI exposure to trusted networks
- Run the service with a dedicated least-privileged account and restrict filesystem access
- Apply sandboxing and resource controls to limit the effect of process compromise
How teams detect issues like this
Organizations can look for command-injection risks through:
- Static analysis rules identifying shell execution APIs fed by request or form data
- Code review checks for string concatenation or interpolation in command construction
- Tests that verify path inputs are passed as discrete arguments and cannot alter process behavior
- Web application policies requiring authentication and network restrictions for administrative processing interfaces
- Runtime monitoring for unexpected child processes, command interpreters, or outbound connections from the media-processing service
- Automated security review tools that flag untrusted input reaching process-spawning functions
Organizations can look for command-injection risks through:
- Static analysis rules identifying shell execution APIs fed by request or form data
- Code review checks for string concatenation or interpolation in command construction
- Tests that verify path inputs are passed as discrete arguments and cannot alter process behavior
- Web application policies requiring authentication and network restrictions for administrative processing interfaces
- Runtime monitoring for unexpected child processes, command interpreters, or outbound connections from the media-processing service
- Automated security review tools that flag untrusted input reaching process-spawning functions
