CVE-2025-49836 is a critical (CVSS 9.8) command injection flaw in GPT-SoVITS WebUI version 20250228v3 and earlier. User input in path_list is joined into a command run by the change_label function in webui.py. No patched version was available when the CVE was published, so restrict access to the WebUI.
What's affected
GPT-SoVITS WebUI, versions 20250228v3 and prior, per the record. The problem sits in the change_label function in webui.py, where the value of path_list comes from user input.
The record states that at the time of publication no known patched versions were available. It does not name a fixed release. That makes the usual advice, upgrade to a fixed version, impossible to give with confidence. Check the project's repository and releases page for any change since, and read the GitHub Security Lab advisory that the record links.
The CVSS vector shows a network attack with no privileges needed and no user interaction. For a tool normally run by one person on their own machine, the real question is whether the WebUI is reachable from anywhere else.
How to check if you're exposed
GPT-SoVITS is normally installed from the project's git repository, so there is no package version to query. Check which commit or release you have:
git -C /path/to/GPT-SoVITS log -1 --format="%H %cd"
Compare the date with the release the advisory names. Then see whether the WebUI is listening beyond your own machine:
ss -ltnp | grep -i python
A listener on 0.0.0.0 or on a public address, as opposed to 127.0.0.1, means other hosts can reach it. If you run it in a container or on a cloud notebook, check the published ports and any share link the notebook created.
What to do now
- Find every running copy of GPT-SoVITS WebUI, including shared servers and cloud notebooks.
- Bind the WebUI to localhost, or put it behind authentication and a VPN. Do not expose it to the internet.
- Do not run the WebUI as an administrator or root account, and keep it away from data you cannot afford to lose.
- Watch the project's repository for a fix and update when one is released.
- Review the host for unexpected processes or files if the WebUI was ever reachable from outside.
- Keep credentials and cloud keys off machines that run it.
Why it matters
The weakness is CWE-77, command injection. The web interface builds a command line by concatenating values from the form, then runs it on the server. Anything the form accepts becomes part of the command, so the person using the page can run commands as the user who started the WebUI.
The same family of mistakes appears in several functions of webui.py. GitHub Security Lab reported four related command injections together, and this entry is one of them. The siblings are CVE-2025-49833, CVE-2025-49834, CVE-2025-49835.
The fix pattern is well known. Build the command as a list of arguments and run it without a shell, validate paths against an allowed directory, and never join raw form values into a string. Check the project repository for whether it has adopted this.
The record's KEV flag is false, and I did not find a source that says it was exploited in the wild.
Quick check
Is there a fixed version for CVE-2025-49836?
The record says no known patched versions were available at publication. Check the project repository for newer releases.
I run it only for myself. Do I need to act?
Less urgently. If the WebUI listens only on localhost and no one else can reach it, the exposure is small. Check that it is not bound to a public address.
Sources
Safeguard has a free in-browser dependency scan at gold.safeguard.sh/scan for the libraries in projects you manage.
Last reviewed: 18 October 2026.
