CVE-2025-43844: GHSL-2025-012_GHSL-2025-022: Multiple vulnerabilities in Retrieval-based-Voice-Conversion-WebUI - CVE-2025-43842_CVE-2025-43852
Retrieval-based-Voice-Conversion-WebUI is a voice changing framework based on VITS. Versions 2.2.231006 and prior are vulnerable to command injection. The variables expdir1, among others, take user input and pass it to the clicktrain function, which concatenates them into a command that is run on the server. This can lead to arbitrary command execution. As of time of publication, no known patches exist.
Other sources
Retrieval-based-Voice-Conversion-WebUI is vulnerable to commandline injection
— GitHub Security Lab
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-43844?
CVE-2025-43844 has a high severity rating due to its potential for command injection.
How do I fix CVE-2025-43844?
To fix CVE-2025-43844, upgrade Retrieval-based Voice Conversion WebUI to version 2.2.231007 or later.
What are the affected versions of CVE-2025-43844?
The affected versions of CVE-2025-43844 are Retrieval-based Voice Conversion WebUI versions 2.2.231006 and earlier.
What type of vulnerability is CVE-2025-43844?
CVE-2025-43844 is classified as a command injection vulnerability.
What function is exploited in CVE-2025-43844?
The vulnerability in CVE-2025-43844 is exploited through user input in the click_train function.