Command Injection Vulnerability

[aydinnyunus]

📌 Description

The following line of code is vulnerable to command injection:

• https://github.com/RVC-Boss/GPT-SoVITS/blob/main/tools/uvr5/vr.py#L143

os.system("ffmpeg -i %s -vn %s -q:a 2 -y" % (path, opt_format_path))

The inputs path and opt_format_path are directly concatenated into a shell command without any sanitization or validation. If a malicious user is able to influence the content of either path or opt_format_path, they could inject arbitrary shell commands, leading to remote code execution (RCE).

---

✅ Proof of Concept

If path is set to a malicious input like:

path = "input.wav; rm -rf /important_data"

The constructed command would become:

ffmpeg -i input.wav; rm -rf /important_data -vn output.wav -q:a 2 -y

Which would execute the destructive rm -rf command.

---

🔧 Recommendation

Avoid using os.system() with unsanitized inputs. Use the subprocess module with argument lists to avoid shell injection:

import subprocess
subprocess.run(["ffmpeg", "-i", path, "-vn", opt_format_path, "-q:a", "2", "-y"], check=True)

This ensures each argument is passed safely, regardless of its content.