CVE-2025-49838
Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.
NVD · uneditedGPT-SoVITS-WebUI is a voice conversion and text-to-speech webUI. In versions 20250228v3 and prior, there is an unsafe deserialization vulnerability in vr.py AudioPreDeEcho. The model_choose variable takes user input (e.g. a path to a model) and passes it to the uvr function. In uvr, a new instance of AudioPreDeEcho class is created with the model_path attribute containing the aforementioned user input (here called locally model_name). Note that in this step the .pth extension is added to the path. In the AudioPreDeEcho class, the user input, here called model_path, is used to load the model on that path with torch.load, which can lead to unsafe deserialization. At time of publication, no known patched versions are available.
Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.
dbcve analysis · high confidenceGPT-SoVITS-WebUI versions 20250228v3 and prior contain an unsafe deserialization vulnerability where user-supplied model file paths are passed directly to torch.load() without validation. An attacker can provide a malicious .pth file containing serialized Python objects that execute arbitrary code during deserialization, achieving remote code execution.
Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.
Affected products & versions What the vendor confirmedThe version ranges the vendor confirmed as vulnerable. If your version sits inside a range here, treat yourself as exposed until you have upgraded.
NVD · CPE data<= 20250228v3CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.
From the vector- Attack vector
- Network
- Complexity
- Low
- Privileges
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- High
- Availability
- High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.
dbcve checksWork through these to decide whether this CVE applies to you.
-
Identify GPT-SoVITS-WebUI installation and versionCheck the installed version by inspecting the webui repository, version file, or git tags. Look for a version marker like '20250228v3' or check the version.py file if one exists.Affected if The installed version is 20250228v3 or earlier (any version prior to a patched release).
-
Locate the vr.py file in the installationFind the vr.py file in the GPT-SoVITS-WebUI codebase. Common paths include the root directory or a 'inference' subdirectory. Confirm the file exists and contains the AudioPreDeEcho class definition.Affected if The vr.py file exists and contains the AudioPreDeEcho class.
-
Inspect torch.load usage in AudioPreDeEcho classOpen vr.py and locate the AudioPreDeEcho class. Search for torch.load calls within this class or its methods. Examine whether the torch.load function is called with user-supplied model path variables without the weights_only=True parameter.Affected if The code uses torch.load() on a model path variable without weights_only=True or input validation.
-
Determine if model path input is exposed to usersCheck the webui interface, API endpoints, or any user-facing code that accepts model paths and passes them to the AudioPreDeEcho class or torch.load function. Look for form inputs, API parameters, or configuration options that specify .pth model files.Affected if Users can supply or specify arbitrary model file paths that reach the vulnerable torch.load call.
-
Verify model files are loaded from untrusted sourcesExamine the application's configuration or logs to determine if model files can be loaded from user-provided locations, external URLs, or directories writable by untrusted users, rather than only from a curated trusted model directory.Affected if The application loads .pth model files from paths users control or from untrusted locations.
A user is affected if they run GPT-SoVITS-WebUI version 20250228v3 or earlier, the vulnerable torch.load pattern exists in vr.py without weights_only=True, and users can supply arbitrary model paths that get passed to this unsafe load function.
Generated from the published advisory. Verify against your own configuration.
Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.
dbcve · scopedImplement strict allowlist-based validation for model paths before passing to torch.load, or use torch.load with weights_only=True parameter to disable arbitrary object deserialization. Restrict network access to the webUI until a patch is available.
- This vulnerability has no available patch at time of CVE publication. The vendor has not released a fixed version.
- If possible, restrict access to the web interface to trusted users only to reduce exposure.
- Consider implementing input validation to sanitize model_path before use, though this is not a complete fix.
- Monitor the project's official GitHub repository for future security updates.
- As a workaround, avoid exposing the webUI to untrusted networks or the public internet.
Generated from the published advisory — verify against the referenced sources before acting.
- Consultation4.0 h
- Implementation8.0 h
- Testing4.0 h
- Review / QA2.0 h
An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $5,120.
Scan for this in your stack
Free · runs locallyCheck whether your project pulls in CVE-2025-49838 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.
References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.
Primary sourcesPractitioner notes
ContributedPeer-ranked notes from engineers who’ve handled CVE-2025-49838 in production — separate from our analysis above.
The advisory tells you what broke. It rarely tells you what actually worked. If you’ve dealt with this one, that detail is what the next engineer is searching for.
- The version that genuinely resolved it — not the one the vendor claimed
- A config change or rule that shut the vector down
- A gotcha in the upgrade path that cost you an afternoon
No notes yet
Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.
A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.
- Verified mitigations, workarounds, and config changes
- Version or environment caveats, and links to real fixes
- No weaponised exploit code, or anything meant to cause harm
- No spam, self-promotion, credentials, or personal data