https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2025-49841.htmlhttps://patchthecve.com/cve/CVE-2025-49841.htmlWed, 17 Jun 2026 09:31:59 +0000CRITICAL 9.8: GPT-SoVITS-WebUI is a voice conversion and text-to-speech webUI. In versions 20250228v3 and prior, there is an unsafe deserialization vulnerability in process_ckpt.py. The SoVITS_dropdown variable takes user input and passes it to the load_sovits_new function in process_ckpt.py. In load_sovits_new, https://patchthecve.com/cve/CVE-2025-49840.htmlhttps://patchthecve.com/cve/CVE-2025-49840.htmlWed, 17 Jun 2026 09:31:59 +0000CRITICAL 9.8: GPT-SoVITS-WebUI is a voice conversion and text-to-speech webUI. In versions 20250228v3 and prior, there is an unsafe deserialization vulnerability in inference_webui.py. The GPT_dropdown variable takes user input and passes it to the change_gpt_weights function. In change_gpt_weights, the user inpuhttps://patchthecve.com/cve/CVE-2025-49839.htmlhttps://patchthecve.com/cve/CVE-2025-49839.htmlWed, 17 Jun 2026 09:31:59 +0000CRITICAL 9.8: GPT-SoVITS-WebUI is a voice conversion and text-to-speech webUI. In versions 20250228v3 and prior, there is an unsafe deserialization vulnerability in bsroformer.py. The model_choose variable takes user input (e.g. a path to a model) and passes it to the uvr function. In uvr, a new instance of Roforhttps://patchthecve.com/cve/CVE-2025-49838.htmlhttps://patchthecve.com/cve/CVE-2025-49838.htmlWed, 17 Jun 2026 09:31:59 +0000CRITICAL 9.8: GPT-SoVITS-WebUI is a voice conversion and text-to-speech webUI. In versions 20250228v3 and prior, there is an unsafe deserialization vulnerability in vr.py AudioPreDeEcho. The model_choose variable takes user input (e.g. a path to a model) and passes it to the uvr function. In uvr, a new instance ohttps://patchthecve.com/cve/CVE-2025-49837.htmlhttps://patchthecve.com/cve/CVE-2025-49837.htmlWed, 17 Jun 2026 09:31:59 +0000CRITICAL 9.8: GPT-SoVITS-WebUI is a voice conversion and text-to-speech webUI. In versions 20250228v3 and prior, there is an unsafe deserialization vulnerability in vr.py AudioPre. The model_choose variable takes user input (e.g. a path to a model) and passes it to the uvr function. In uvr, a new instance of Audihttps://patchthecve.com/cve/CVE-2025-49836.htmlhttps://patchthecve.com/cve/CVE-2025-49836.htmlWed, 17 Jun 2026 09:31:59 +0000CRITICAL 9.8: GPT-SoVITS-WebUI is a voice conversion and text-to-speech webUI. In versions 20250228v3 and prior, there is a command injection vulnerability in webui.py change_label function. path_list takes user input, which is passed to the change_label function, which concatenates the user input into a command https://patchthecve.com/cve/CVE-2025-49835.htmlhttps://patchthecve.com/cve/CVE-2025-49835.htmlWed, 17 Jun 2026 09:31:59 +0000CRITICAL 9.8: GPT-SoVITS-WebUI is a voice conversion and text-to-speech webUI. In versions 20250228v3 and prior, there is a command injection vulnerability in webui.py open_asr function. asr_inp_dir (and a number of other variables) takes user input, which is passed to the open_asr function, which concatenates thhttps://patchthecve.com/cve/CVE-2025-49834.htmlhttps://patchthecve.com/cve/CVE-2025-49834.htmlWed, 17 Jun 2026 09:31:58 +0000CRITICAL 9.8: GPT-SoVITS-WebUI is a voice conversion and text-to-speech webUI. In versions 20250228v3 and prior, there is a command injection vulnerability in webui.py open_denoise function. denoise_inp_dir and denoise_opt_dir take user input, which is passed to the open_denoise function, which concatenates the uhttps://patchthecve.com/cve/CVE-2025-49833.htmlhttps://patchthecve.com/cve/CVE-2025-49833.htmlWed, 17 Jun 2026 09:31:58 +0000CRITICAL 9.8: GPT-SoVITS-WebUI is a voice conversion and text-to-speech webUI. In versions 20250228v3 and prior, there is a command injection vulnerability in the webui.py open_slice function. slice_opt_root and slice-inp-path takes user input, which is passed to the open_slice function, which concatenates the us