CVE-2025-43845: GHSL-2025-012_GHSL-2025-022: Multiple vulnerabilities in Retrieval-based-Voice-Conversion-WebUI - CVE-2025-43842_CVE-2025-43852
Retrieval-based-Voice-Conversion-WebUI is a voice changing framework based on VITS. Versions 2.2.231006 and prior are vulnerable to code injection. The ckptpath2 variable takes user input (e.g. a path to a model) and passes it to changeinfo function, which opens and reads the file on the given path (except it changes the final on the path to train.log), and passes the contents of the file to eval, which can lead to remote code execution. As of time of publication, no known patches exist.
Other sources
Retrieval-based-Voice-Conversion-WebUI is vulnerable to commandline injection
— GitHub Security Lab
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-43845?
CVE-2025-43845 is classified as a code injection vulnerability with moderate severity.
How do I fix CVE-2025-43845?
To fix CVE-2025-43845, update Retrieval-based-Voice-Conversion-WebUI to version 2.2.231007 or later.
What specific versions are affected by CVE-2025-43845?
CVE-2025-43845 affects all versions of Retrieval-based-Voice-Conversion-WebUI up to and including version 2.2.231006.
What is the impact of CVE-2025-43845 on my system?
The impact of CVE-2025-43845 includes the potential for unauthorized code execution due to improper handling of user input.
Can CVE-2025-43845 be exploited remotely?
Yes, CVE-2025-43845 can be exploited remotely if the vulnerable application is accessible over the internet.