CVE-2025-43846: GHSL-2025-012_GHSL-2025-022: Multiple vulnerabilities in Retrieval-based-Voice-Conversion-WebUI - CVE-2025-43842_CVE-2025-43852
Retrieval-based-Voice-Conversion-WebUI is a voice changing framework based on VITS. Versions 2.2.231006 and prior are vulnerable to unsafe deserialization. The ckptpath1 variable takes user input (e.g. a path to a model) and passes it to the showinfo function in processckpt.py, which uses it to load the model on that path with torch.load, which can lead to unsafe deserialization and remote code execution. As of time of publication, no known patches exist.
Other sources
Retrieval-based-Voice-Conversion-WebUI is vulnerable to commandline injection
— GitHub Security Lab
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-43846?
CVE-2025-43846 is considered a high severity vulnerability due to its potential for unsafe deserialization, leading to arbitrary code execution.
How do I fix CVE-2025-43846?
To mitigate CVE-2025-43846, upgrade Retrieval-based Voice Conversion WebUI to version 2.2.231007 or later, where the vulnerability has been addressed.
What causes CVE-2025-43846?
CVE-2025-43846 is caused by the unsafe handling of user input through the ckpt_path1 variable in the process_ckpt.py module.
What are the risks associated with CVE-2025-43846?
The risks associated with CVE-2025-43846 include potential arbitrary code execution and the exploitation of the affected application by an attacker.
Is my version affected by CVE-2025-43846?
Versions of Retrieval-based Voice Conversion WebUI prior to 2.2.231007 are affected by CVE-2025-43846.