{"data":{"id":"06cb7918-5642-459d-8686-e2f802304fb9","title":"CVE-2026-63766: GPT-SoVITS through 20250606v2pro contains an OS command injection vulnerability in webui.py where ASR, slice, denoise, a","summary":"GPT-SoVITS (a voice synthesis tool) version 20250606v2pro has an OS command injection vulnerability (a security flaw where attackers can run unauthorized commands on a server by inserting malicious text) in its webui.py file. The vulnerability affects ASR, slice, denoise, and uvr5 functions that take user input from Gradio textboxes (input fields in a web interface) and directly insert it into shell commands without checking for dangerous characters, allowing attackers to execute arbitrary commands without authentication.","solution":"N/A -- no mitigation discussed in source.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-63766","publishedAt":"2026-07-20T20:16:46.170Z","cveId":"CVE-2026-63766","cweIds":["CWE-78"],"cvssScore":"9.8","cvssSeverity":"critical","severity":"critical","attackType":["other"],"issueType":"vulnerability","affectedPackages":null,"affectedVendors":[],"affectedVendorsRaw":["GPT-SoVITS"],"classifierModel":"claude-haiku-4-5-20251001","classifierPromptVersion":"v3","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","attackVector":"network","attackComplexity":"low","privilegesRequired":"none","userInteraction":"none","exploitMaturity":"unknown","epssScore":0,"patchAvailable":null,"disclosureDate":"2026-07-20T20:16:46.170Z","capecIds":["CAPEC-88"],"crossRefCount":0,"attackSophistication":"trivial","impactType":["confidentiality","integrity","availability"],"aiComponentTargeted":"api","llmSpecific":false,"classifierConfidence":0.85,"researchCategory":null,"atlasIds":null}}