CVE-2026-63766 is an OS command injection vulnerability in RVC-Boss's GPT-SoVITS product affecting versions up to 20250606v2pro. The issue is located in webui.py where user-supplied input from Gradio textboxes is unsafely embedded into shell commands executed with shell=True. This lack of input sanitization enables attackers to inject shell metacharacters and execute arbitrary operating system commands without authentication. The vulnerability has a CVSS 4.0 score of 9.3, indicating critical severity with network attack vector, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability. No official patch or remediation guidance is currently available, and no known exploits in the wild have been reported.

Successful exploitation allows unauthenticated remote attackers to execute arbitrary OS commands on the server hosting GPT-SoVITS with the privileges of the server process user. This can lead to full system compromise, data theft, service disruption, or further lateral movement within the affected environment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should avoid exposing the vulnerable web interface to untrusted networks and consider disabling or restricting access to the affected functions (ASR, slice, denoise, uvr5) that interpolate user input into shell commands. Input sanitization or use of safer command execution methods (avoiding shell=True) should be implemented by the vendor.