CVE-2025-43848: GHSL-2025-012_GHSL-2025-022: Multiple vulnerabilities in Retrieval-based-Voice-Conversion-WebUI - CVE-2025-43842_CVE-2025-43852
Retrieval-based-Voice-Conversion-WebUI is a voice changing framework based on VITS. Versions 2.2.231006 and prior are vulnerable to unsafe deserialization. The ckptpath0 variable takes user input (e.g. a path to a model) and passes it to the changeinfo function in processckpt.py, which uses it to load the model on that path with torch.load, which can lead to unsafe deserialization and remote code execution. As of time of publication, no known patches exist.
Other sources
Retrieval-based-Voice-Conversion-WebUI is vulnerable to commandline injection
— GitHub Security Lab
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-43848?
CVE-2025-43848 has a high severity due to the unsafe deserialization vulnerability that can lead to remote code execution.
How do I fix CVE-2025-43848?
To fix CVE-2025-43848, upgrade Retrieval-based Voice Conversion WebUI to version 2.2.231007 or later.
What versions of Retrieval-based Voice Conversion WebUI are affected by CVE-2025-43848?
Versions 2.2.231006 and prior of Retrieval-based Voice Conversion WebUI are affected by CVE-2025-43848.
What kind of attack can be executed due to CVE-2025-43848?
CVE-2025-43848 allows attackers to perform remote code execution by exploiting unsafe deserialization.
Is user input directly involved in CVE-2025-43848?
Yes, CVE-2025-43848 involves user input through the ckpt_path0 variable, which can lead to vulnerabilities.