CVE-2025-49840 is a critical (CVSS 9.8) unsafe deserialization flaw in GPT-SoVITS WebUI version 20250228v3 and earlier. A model path chosen in the interface is loaded with torch.load in the change_gpt_weights function in inference_webui.py. No patched version was available at publication, so load only trusted model files and limit access.
What's affected
GPT-SoVITS WebUI, versions 20250228v3 and prior, per the record. The problem sits in the change_gpt_weights function in inference_webui.py, where the value of GPT_dropdown comes from user input.
The record states that at the time of publication no known patched versions were available. It does not name a fixed release. That makes the usual advice, upgrade to a fixed version, impossible to give with confidence. Check the project's repository and releases page for any change since, and read the GitHub Security Lab advisory that the record links.
The CVSS vector shows a network attack with no privileges needed and no user interaction. For a tool normally run by one person on their own machine, the real question is whether the WebUI is reachable from anywhere else.
How to check if you're exposed
GPT-SoVITS is normally installed from the project's git repository, so there is no package version to query. Check which commit or release you have:
git -C /path/to/GPT-SoVITS log -1 --format="%H %cd"
Compare the date with the release the advisory names. Then see whether the WebUI is listening beyond your own machine:
ss -ltnp | grep -i python
A listener on 0.0.0.0 or on a public address, as opposed to 127.0.0.1, means other hosts can reach it. If you run it in a container or on a cloud notebook, check the published ports and any share link the notebook created.
What to do now
- Find every running copy of GPT-SoVITS WebUI, including shared servers and cloud notebooks.
- Bind the WebUI to localhost, or put it behind authentication and a VPN. Do not expose it to the internet.
- Only load model files that you built yourself or obtained from a source you trust, and treat downloaded checkpoints as code.
- Watch the project's repository for a fix and update when one is released.
- Review the host for unexpected processes or files if the WebUI was ever reachable from outside.
- Keep credentials and cloud keys off machines that run it.
Why it matters
The weakness is CWE-502, deserialization of untrusted data. PyTorch model files are built on Python's pickle format, and loading a pickle can run code that the file contains. If the application lets a user choose which file to load, the choice of file becomes a choice of code to run.
This is one of five related deserialization reports from the same disclosure. The others are CVE-2025-49837, CVE-2025-49838, CVE-2025-49839, CVE-2025-49841. Together they show the pattern across the project: several load points take a model path from the interface.
PyTorch offers a weights only loading mode for this reason, and moving model loading to safe formats or restricting the loader is the general remedy. Check the project repository for whether it has adopted either.
The record's KEV flag is false, and I did not find a source that says it was exploited in the wild.
Quick check
Is there a fixed version for CVE-2025-49840?
The record says no known patched versions were available at publication. Check the project repository for newer releases.
I run it only for myself. Do I need to act?
Less urgently. If the WebUI listens only on localhost and no one else can reach it, the exposure is small. Check that it is not bound to a public address.
Sources
Safeguard has a free in-browser dependency scan at gold.safeguard.sh/scan for the libraries in projects you manage.
Last reviewed: 18 October 2026.
