RVC-Boss CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

CRITICAL RVC-Boss CVE published 2026-10-12

CVE-2025-71429

GPT-SoVITS through 20250606v2pro contains an OS command injection vulnerability in tools/uvr5/vr.py, allowing unauthenticated attackers to execute commands via output folder paths. This vulnerability enables attackers to enter shell substitutions in the UVR5 WebUI output folder textboxes during mp3 or m4a export, leading to potential command execution as the server user. The vulnerability's critical sever [truncated]