{"data":{"id":"06cb7918-5642-459d-8686-e2f802304fb9","title":"CVE-2026-63766: GPT-SoVITS through 20250606v2pro contains an OS command injection vulnerability in webui.py where ASR, slice, denoise…","summary":"CVE-2026-63766 affects GPT-SoVITS through 20250606v2pro. In webui.py, the ASR, slice, denoise, and uvr5 functions insert unsanitized Gradio textbox values directly into shell commands run with shell=True. An unauthenticated attacker can inject shell metacharacters through path parameters to execute arbitrary OS commands as the server process user. VulnCheck scores it CVSS 4.0 9.3 (Critical), while NVD has not yet provided an assessment.","solution":"N/A -- no mitigation discussed in source.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-63766","publishedAt":"2026-07-20T20:16:46.170Z","cveId":"CVE-2026-63766","cweIds":["CWE-78"],"cvssScore":"9.8","cvssSeverity":"critical","severity":"critical","attackType":["other"],"issueType":"vulnerability","affectedPackages":null,"affectedPackageNames":null,"affectedPackageRefs":null,"affectedVendors":[],"affectedVendorsRaw":["GPT-SoVITS"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"GPT-SoVITS OS command injection in webui.py through ASR and slice paths","headlinePromptVersion":"h1","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","attackVector":"network","attackComplexity":"low","privilegesRequired":"none","userInteraction":"none","exploitMaturity":"unknown","epssScore":0.02148,"epssCheckedAt":"2026-11-12T15:03:09.141Z","kevDateAdded":null,"advisoryAliases":["GHSA-9673-c4fc-mjq2"],"affectedPackagesSource":null,"affectedPackagesCheckedAt":"2026-11-09T18:09:57.464Z","patchAvailable":null,"disclosureDate":"2026-07-20T20:16:46.170Z","fixReleasedAt":null,"daysToFix":null,"fixCheckedAt":null,"capecIds":["CAPEC-88"],"crossRefCount":0,"attackSophistication":"trivial","impactType":["confidentiality","integrity","availability"],"aiComponentTargeted":"inference","llmSpecific":false,"classifierConfidence":0.9,"researchCategory":null,"atlasIds":null,"fixes":[]}}