GPT-SoVITS webui.py Unauthenticated OS Command Injection

Technical Analysis

The vulnerability resides in webui.py, where user-supplied Gradio textbox values (file/directory paths for ASR, audio slicing, denoising, and vocal separation functions) are interpolated directly into shell commands invoked with shell=True, rather than being passed as sanitized argument lists or validated against a strict allowlist. This is a classic unsanitized-input-to-shell pattern (similar in class to CWE-78) that allows remote attackers to append shell metacharacters (e.g., ;, |, $()) to achieve arbitrary command execution with the privileges of the web UI process. Because GPT-SoVITS is frequently self-hosted, exposed on internal networks, or deployed behind minimal reverse proxies for demos and internal tooling, the attack surface includes any instance reachable over HTTP without additional authentication layers. Organizations that integrate GPT-SoVITS as a voice-generation tool within AI agent pipelines (e.g., agents that call it for TTS output, or expose it as a callable tool/microservice) face direct risk of full host compromise, which could lead to lateral movement, exfiltration of API keys/credentials used by co-located agent processes, or poisoning of the agent's tool-execution environment.

Affected Systems

GPT-SoVITS repository versions up to and including 20250606v2pro; specifically webui.py functions handling ASR (automatic speech recognition), audio slicing, denoising, and UVR5 (vocal/instrument separation) that accept path parameters via Gradio textbox inputs and execute them via shell=True subprocess calls.

Indicators of Compromise

• webui.py (modified/exploited copies)
• Anomalous shell metacharacters in ASR/slice/denoise/uvr5 path parameters (e.g., ;, |, `, $())
• Unexpected child processes spawned from Python webui.py process
• Outbound connections initiated from GPT-SoVITS host shortly after form submission to ASR/UVR5 endpoints

Remediation Steps

1. 1

   Upgrade or Patch

   Update GPT-SoVITS to a patched release once available from the maintainers; monitor the official repository for a security fix addressing shell=True usage in webui.py.

2. 2

   Restrict Network Exposure

   Do not expose the GPT-SoVITS Gradio web UI directly to the internet. Place it behind a VPN, authentication proxy, or firewall restricting access to trusted internal users only.

3. 3

   Input Sanitization Workaround

   If patching is not immediately possible, manually modify webui.py to avoid shell=True and use subprocess argument lists (e.g., subprocess.run([...], shell=False)) with strict path validation/allowlisting for all ASR, slice, denoise, and uvr5 functions.

4. 4

   Isolate and Sandbox

   Run GPT-SoVITS in an isolated container or VM with minimal privileges and no access to sensitive credentials, agent API keys, or internal networks, to limit blast radius if exploited.

5. 5

   Audit Agent Integrations

   If GPT-SoVITS is used as a tool/service within AI agent workflows, audit which credentials or secrets are accessible from that host and rotate any API keys or tokens that could be exposed via command execution.

6. 6

   Monitor and Detect

   Deploy process and network monitoring on hosts running GPT-SoVITS to detect anomalous subprocess spawning or outbound connections correlated with web UI requests.