GPT-SoVITS

Risks & limits

Security vulnerabilities. GitHub Security Lab disclosed 9 vulnerabilities on 2025-06-27 (CVE-2025-49833 to CVE-2025-49841), tested against 20250228v3. Four are command injection: the slicing, denoising, speech-recognition and labelling entry points in webui.py splice user input directly into shell commands; the other five are unsafe deserialisation in the UVR5 separation module, the inference UI and the model-weight handling code, where loading a maliciously crafted model file is enough to run arbitrary code. The NVD record for CVE-2025-49833 carries a CVSS 4.0 score of 8.9 (high) from GitHub as the numbering authority. Per issue #2194, the researcher asked for a vulnerability-report contact on 2025-03-15, followed up twice on 05-06 and 06-30, and on 07-08 commented that, having had no reply, the report had been published. As of commit b4570b8 on main on 2026-10-19, webui.py still runs spliced commands with shell=True, and inference_webui.py and process_ckpt.py still load weights with explicit weights_only=False; the three UVR5 load points (two in vr.py, one in bsroformer.py) don't set weights_only explicitly, and the PyTorch docs say the default changed to weights_only=True from 2.6, so the risk at these three points depends on the version in use, and older versions in the README's test table such as 2.5.1 and 2.2.2 are still affected. The main WebUI and the inference WebUI bind 0.0.0.0, and Gradio is launched with no login authentication; setting the environment variable is_share to True also creates a public Gradio link, which the changelog says is meant for settings such as Colab. The /set_gpt_weights and /set_sovits_weights endpoints in api_v2.py accept any weight path, and the backend likewise loads them with weights_only=False; it binds only 127.0.0.1 by default, and the -a flag makes it listen externally. The repo has no SECURITY.md, and its GitHub security advisories page is empty.

Technical checks. The code has no licence keys, activation or use-case detection, and anyone who downloads it can use every feature. Several Gradio interfaces set analytics_enabled=False, turning off Gradio's built-in usage statistics. The WebUI and README also offer no speaker-consent verification or watermarking of synthesised audio.

Legal framing. The project's own licence is only the MIT LICENSE at the root; third-party code distributed with the repo carries its own licences. The top of both the main WebUI and the inference UI shows a statement, which the English UI renders as: "This software is open source under the MIT license. The author does not have any control over the software. Users who use the software and distribute the sounds exported by the software are solely responsible." It is followed by: "If you do not agree with this clause, you cannot use or reference any codes and files within the software package. See the root directory Agreement-LICENSE for details." The wording of the second sentence is stricter than the MIT text, and the LICENSE file itself contains no such clause. Cloning someone else's voice also touches voice rights, portrait rights and local rules on deep-synthesis content, and under the statement those responsibilities fall entirely on the user.

Training data. The wiki gives only the duration of the base-model training data: about 2,000 hours for v1, about 5,000 hours in total for v2's SoVITS part (about 2,500 hours for the GPT part), and about 7,000 hours from v3 on, while the V5 notes say the diffusion model used a 5,000-hour training set. The README's to-do list has the item "Try expand training dataset (2k hours -> 10k hours)." checked as done, which doesn't match the wiki's figures.

Maintenance and versions. Of the 1,065 commits on main, 620 come from RVC-Boss alone; there are 800 open issues; the latest release is still from 2025-06-06, and V5 exists only as branches and commits, with no version tag.