CVE-2026-63766 is an OS command injection vulnerability in RVC-Boss's GPT-SoVITS product affecting versions up to 20250606v2pro. The issue is located in webui.py where the ASR, slice, denoise, and uvr5 functions incorporate unsanitized input from Gradio textboxes directly into shell commands executed with shell=True. This improper neutralization of special elements enables attackers to inject shell metacharacters through path parameters, resulting in arbitrary command execution on the host system without requiring authentication.

Successful exploitation allows unauthenticated attackers to execute arbitrary operating system commands with the privileges of the server process user. This can lead to full system compromise, data theft, service disruption, or further lateral movement within the affected environment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid exposing the vulnerable web interface to untrusted networks. Consider disabling or restricting access to the affected functions (ASR, slice, denoise, uvr5) that interpolate user input into shell commands. Implement input validation and sanitization to prevent injection of shell metacharacters. Monitor for updates from the vendor regarding patches or official mitigations.