CVE-2025-43843: GHSL-2025-012_GHSL-2025-022: Multiple vulnerabilities in Retrieval-based-Voice-Conversion-WebUI - CVE-2025-43842_CVE-2025-43852
Retrieval-based-Voice-Conversion-WebUI is a voice changing framework based on VITS. Versions 2.2.231006 and prior are vulnerable to command injection. The variables expdir1, np7 and f0method8 take user input and pass it into the extractf0feature function, which concatenates them into a command that is run on the server. This can lead to arbitrary command execution. As of time of publication, no known patches exist.
Other sources
Retrieval-based-Voice-Conversion-WebUI is vulnerable to commandline injection
— GitHub Security Lab
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-43843?
CVE-2025-43843 is classified as a critical vulnerability due to its potential to allow command injection.
How do I fix CVE-2025-43843?
To fix CVE-2025-43843, upgrade Retrieval-based Voice Conversion WebUI to version 2.2.231007 or later.
What types of input can be exploited in CVE-2025-43843?
The vulnerable variables exp_dir1, np7, and f0method8 can be exploited through arbitrary user input.
What is the impact of CVE-2025-43843?
The impact of CVE-2025-43843 includes unauthorized command execution on the affected system.
Is CVE-2025-43843 present in all versions of Retrieval-based Voice Conversion WebUI?
CVE-2025-43843 affects Retrieval-based Voice Conversion WebUI versions 2.2.231006 and prior.