CVE-2025-43842: GHSL-2025-012_GHSL-2025-022: Multiple vulnerabilities in Retrieval-based-Voice-Conversion-WebUI - CVE-2025-43842_CVE-2025-43852
Retrieval-based-Voice-Conversion-WebUI is a voice changing framework based on VITS. Versions 2.2.231006 and prior are vulnerable to command injection. The variables expdir1, np7, trainsetdir4 and sr2 take user input and pass it to the preprocessdataset function, which concatenates them into a command that is run on the server. This can lead to arbitrary command execution. As of time of publication, no known patches exist.
Other sources
Retrieval-based-Voice-Conversion-WebUI is vulnerable to commandline injection
— GitHub Security Lab
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-43842?
CVE-2025-43842 is classified as a critical command injection vulnerability.
How do I fix CVE-2025-43842?
To fix CVE-2025-43842, upgrade the Retrieval-based Voice Conversion WebUI to version 2.2.231007 or later.
What software is affected by CVE-2025-43842?
CVE-2025-43842 affects Retrieval-based Voice Conversion WebUI versions 2.2.231006 and prior.
What are the potential impacts of CVE-2025-43842?
Successful exploitation of CVE-2025-43842 could allow an attacker to execute arbitrary commands on the server.
How can CVE-2025-43842 be exploited?
CVE-2025-43842 can be exploited through user input variables that are inadequately sanitized before being passed to the preprocess_dataset function.