CVE-2025-49838

CVE-2025-49838 is a critical unsafe deserialization vulnerability affecting GPT-SoVITS-WebUI versions 20250228v3 and prior. An attacker can exploit this by providing malicious user input for the model_choose variable, which is then used to load an arbitrary model via torch.load, leading to remote code execution. This vulnerability has a CVSS score of 9.8 (CRITICAL) due to its network-based attack vector, low attack complexity, and high impact on confidentiality, integrity, and availability. While there are no known active exploits or public exploit code, the vulnerability has garnered significant community discussion, indicating potential future exploitation interest.