Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
GHSL-2025-053: GPT-SoVITS Deserialization of Untrusted Data vulnerability
Vulnerability Description
GPT-SoVITS-WebUI is a voice conversion and text-to-speech webUI. In versions 20250228v3 and prior, there is an unsafe deserialization vulnerability in process_ckpt.py. The SoVITS_dropdown variable takes user input and passes it to the load_sovits_new function in process_ckpt.py. In load_sovits_new, the user input, here sovits_path is used to load a model with torch.load, leading to unsafe deserialization. At time of publication, no known patched versions are available.
CVSS Information
N/A
Vulnerability Type
可信数据的反序列化
Vulnerability Title
GPT-SoVITS-WebUI 代码问题漏洞
Vulnerability Description
GPT-SoVITS-WebUI是RVC-Boss个人开发者的一个TTS训练模型。 GPT-SoVITS-WebUI 20250228v3及之前版本存在代码问题漏洞，该漏洞源于process_ckpt.py存在不安全反序列化，可能导致执行任意代码。
CVSS Information
N/A
Vulnerability Type
N/A