CVE-2025-49839: GPT-SoVITS-WebUI is a voice conversion and text-to-speech webUI. In versions 20250228v3 and prior, there is an unsafe de
Summary
GPT-SoVITS-WebUI, a tool for converting voices and generating speech from text, has a vulnerability in versions 20250228v3 and earlier where user input (like a file path) is passed directly to torch.load, a function that can execute malicious code when loading files. An attacker could exploit this by providing a specially crafted model file that runs unauthorized code on the system.
Vulnerability Details
9.8(critical)
EPSS: 0.2%
Classification
Affected Vendors
Related Issues
Original source: https://nvd.nist.gov/vuln/detail/CVE-2025-49839
First tracked: February 15, 2026 at 08:53 PM
Classified by LLM (prompt v3) · confidence: 95%