GPT-SoVITS-WebUI Command Injection Vulnerability in Change_Label Function

A command injection vulnerability has been identified in GPT-SoVITS-WebUI, specifically in versions through 20250228v3. The issue arises in the webui.py file, within the change_label function. User input from the path_list variable is improperly sanitized and concatenated into a command that is executed on the server. This flaw allows for arbitrary command execution.

Impact

Exploitation of this vulnerability could lead to arbitrary command execution on the server where GPT-SoVITS-WebUI is running.

Reproduction

To reproduce this vulnerability, input a crafted path list into the change_label function. The input is not properly sanitized, allowing for the injection of malicious commands that will be executed on the server.