CVE-2025-49841

GHSL-2025-053: GPT-SoVITS Deserialization of Untrusted Data vulnerability

8.9 High

GPT-SoVITS-WebUI is a voice conversion and text-to-speech webUI. In versions 20250228v3 and prior, there is an unsafe deserialization vulnerability in process_ckpt.py. The SoVITS_dropdown variable takes user input and passes it to the load_sovits_new function in process_ckpt.py. In load_sovits_new, the user input, here sovits_path is used to load a model with torch.load, leading to unsafe deserialization. At time of publication, no known patched versions are available.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

0.76%Up 0.7 points since Jul 16, 2025

What each source reports

CVE List Score used 8.9

GHSL-2025-053: GPT-SoVITS Deserialization of Untrusted Data vulnerability

Record: CVE-2025-49841
CVSS 4.0: 8.9 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
Weakness: CWE-502
Updated: 2026-11-02

EUVDEUVD-2025-21557 8.9

Record: EUVD-2025-21557
CVSS 4.0: 8.9 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
Updated: 2026-11-02

NVD 8.9

Record: CVE-2025-49841
CVSS 4.0: 8.9 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-502
Updated: 2026-11-02

OSV 8.9

GHSL-2025-053: GPT-SoVITS Deserialization of Untrusted Data vulnerability

Record: CVE-2025-49841
CVSS 4.0: 8.9 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
Weakness: CWE-502
Updated: 2026-11-02

Affected products

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	CVE List, EUVD, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2025-49841 is a high vulnerability (CVSS 8.9) in Rvc-boss Gpt-sovits, published July 15, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.76%, the 55th percentile. No source names a fixed version.