SoftVC VITS npm Package Path Traversal Vulnerability Under Investigation
An early warning has been issued regarding a potential path traversal vulnerability in the SoftVC VITS npm package, which could allow unauthenticated remote attackers to read and exfiltrate arbitrary files.
What happened
Reportedly, the SoftVC VITS npm package contains a path traversal vulnerability in the full-song inference server. This vulnerability appears to allow unauthenticated remote attackers to read and exfiltrate arbitrary files by supplying attacker-controlled filesystem paths through the audio_path field of an unauthenticated POST request to the /wav2wav route. The vulnerability is under investigation and has been assigned CVE-2026-65701 with a CVSS score of 9.1, indicating a critical severity level. Affected components include the softvc vits npm package. It is recommended to monitor for updates and upgrade to a patched version as soon as it is available. Primary sources should be consulted for the most current information.
How 0Day mitigates this
softvc vits is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.