An unauthenticated OS command injection vulnerability in the GPT-SoVITS web interface allows remote attackers to execute arbitrary code with the privileges of the server process.

The webui.py component suffers from improper neutralization of special elements (CWE-78), where user-supplied input is directly interpolated into shell commands executed with shell=True. This allows an unauthenticated attacker to inject shell metacharacters and execute arbitrary system commands.

The ability for an unauthenticated attacker to achieve remote code execution represents a critical risk to the host system. This can lead to total system takeover, unauthorized access to sensitive data stored on the machine, and potential use of the server as a pivot point for further network attacks. The CVSS score of 9.8 underscores the severity of this exposure.

Immediate Action: Update to the latest version of GPT-SoVITS as provided by the vendor. If an immediate update is not feasible, restrict network access to the web interface to authorized personnel only via a VPN or firewall.

Proactive Monitoring: Monitor system logs for unexpected process creation or command execution originating from the web server process.

Compensating Controls: Deploy a Web Application Firewall (WAF) to detect and block requests containing shell metacharacters in parameters destined for the affected functions.

Public Exploit Available: No (Exploit available: false)

Due to the unauthenticated nature of this critical vulnerability, immediate remediation is required. Administrators should ensure the software is patched and verify that the service is not exposed to the public internet without robust access controls.