NVD CRITICAL: CVE-2025-71429 — GPT-SoVITS through 20250606v2pro contains an OS command injection vulnerability ...

Monday, October 12, 2026 at 09:17 PM UTC·Source: NIST NVD

Updated: Monday, October 12, 2026 at 10:00 PM UTC

Executive Summary

GPT-SoVITS through 20250606v2pro contains an OS command injection vulnerability in tools/uvr5/vr.py that allows unauthenticated attackers to execute commands via output folder paths. Attackers can enter shell substitutions like $(...) in the UVR5 WebUI output folder textboxes with mp3 or m4a export to run commands as the server user.

Analysis

Indicators of Compromise (1)

CVE (1)

CVE-2025-71429

NVD MITRE CVE

Source Attribution

Originally published by NIST NVD on Oct 12, 2026. Verified by: NIST.

Related Threats

MEDIUMVulnerability

LemFi adds credit and eSIM products

LemFi, the financial platform for people building lives across borders, today announced the launch of its new global brand platform, “Ambition has no passport”, alongside a completely rebuilt app, launching the largest product expansion in its history.

1h agoFinextra

LOWVulnerability

CISA Orders Federal Agencies to Patch Exploited Plex2Shell, Siemens, and SiteGuard Flaws

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday added four vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, including four vulnerabilities impacting Plex Media Server that's collectively called Plex2Shell. The vulnerabilities are listed below - CVE-2026-96652 (CVSS score: 5.3) - Plex Media Server Server-Side Request Forgery (SSRF)

CVE-2026-96652

2h agoThe Hacker News

CRITICALVulnerability

PHP2Shell: Mass Exploitation Looms for Leaked Critical PHP Flaws

Tracked as CVE-2026-109618 and CVE-2026-109619, the bugs could potentially lead to unauthenticated remote code execution. The post PHP2Shell: Mass Exploitation Looms for Leaked Critical PHP Flaws appeared first on SecurityWeek .

CVE-2026-109618CVE-2026-109619

2h agoSecurityWeek