CVE-2026-63766Patch

LOWCVSS 9.3 · CRITICAL

Signal is active with 1 mentions in latest observed window

Immediate actions

Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

GPT-SoVITS through 20250606v2pro contains an OS command injection vulnerability in webui.py where ASR, slice, denoise, and uvr5 functions interpolate unsanitized Gradio textbox values directly into shell commands executed with shell=True. Attackers can inject shell metacharacters through path parameters to execute arbitrary OS commands as the server process user without authentication.

Back to dashboard

0.5/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-78

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Threat summary

Patch or workaround signal is available
2 mentions across 2 observed days
Momentum state: stable

What's happening

Patch or workaround mentioned in 1 signal
Technical details provided in 2 signals
Disclosure: 1 classified signal
Peaked 1d ago at 1 mentions (2026-07-20); latest day: 1
2 total mentions across 2 days

Deep dive

Activity timeline2 mentions / 2d

Signal classification2 categories

Patch

150.0%

Disclosure

150.0%

Referenced assets2 URLs

By indicator

Classification over time

Date	Total	Labels

2026-07-20	1	Patch1
2026-07-21	1	Disclosure1

Full discourse2 posts

Orizon@OrizonCyber91d
Patch
🚨 CVE-2026-63766 — CVSS 9.8/10 ██████████ GPT-SoVITS through 20250606v2pro contains an OS command injection vulnerability in http://webui.py where ASR, slice, denoise,... Severity: CRITICAL Patch now. #cybersecurity #CVE https://t.co/fr5bgL1ise
Post summary
The tweet announces CVE-2026-63766 as a critical OS command injection vulnerability with a CVSS score of 9.8, urges users to apply the patch immediately, and provides basic technical details.
1001172
69 followersView on X
takenaka hiroya@Joe_Biden_ja91d
Disclosure
本日、「脆弱性対応ウォッチ」に新たなCritical脆弱性情報を追加しました。GPT-SoVITSをご利用中の方は、「CVE-2026-63766」で報告されているOSコマンド注入の危険性にご注意ください。詳細を確認し、適切な対策を講じる一助となれば幸いです。 https://cve.autoarticles.net/cve/CVE-2026-63766
Post summary
The post announces a new critical vulnerability CVE‑2026‑63766 that enables OS command injection in GPT‑SoVITS users, prompting them to review details and apply countermeasures.
0000079
561 followersView on X

Explore more

Back to dashboard