CVE-2024-39686
fishaudio/Bert-VITS2 Command Injection in webui_preprocess.py bert_gen function
We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.
Please see our statement on Data Privacy.
fishaudio/Bert-VITS2 Command Injection in webui_preprocess.py bert_gen function
| Assigner | GitHub_M |
| Reserved | 2024-06-27 |
| Published | 2024-07-22 |
| Updated | 2024-08-02 |
Bert-VITS2 is the VITS2 Backbone with multilingual bert. User input supplied to the data_dir variable is used directly in a command executed with subprocess.run(cmd, shell=True) in the bert_gen function, which leads to arbitrary command execution. This affects fishaudio/Bert-VITS2 2.3 and earlier.
| CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
https://securitylab.github.com/advisories/GHSL-2024-045_GHSL-2024-047_fishaudio_Bert-VITS2/
