CVE-2025-43849: GHSL-2025-019_Retrieval-based-Voice-Conversion-WebUI
First published: Mon May 05 2025(Updated: )
Retrieval-based-Voice-Conversion-WebUI is a voice changing framework based on VITS. Versions 2.2.231006 and prior are vulnerable to unsafe deserialization. The ckpt_a and cpkt_b variables take user input (e.g. a path to a model) and pass it to the merge function in process_ckpt.py, which uses them to load the models on those paths with torch.load, which can lead to unsafe deserialization and remote code execution. As of time of publication, no known patches exist.
Credit: security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Retrieval-based Voice Conversion Voice Conversion WebUI | <2.2.231006 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://securitylab.github.com/advisories/GHSL-2025-012_GHSL-2025-022_Retrieval-based-Voice-Conversion-WebUI/
- https://github.com/RVC-Project/Retrieval-based-Voice-Conversion-WebUI/blob/7ef19867780cf703841ebafb565a4e47d1ea86ff/infer/lib/train/process_ckpt.py#L196
- https://github.com/RVC-Project/Retrieval-based-Voice-Conversion-WebUI/blob/9f2f0559e6932c10c48642d404e7d2e771d9db43/infer-web.py#L1357
- https://github.com/RVC-Project/Retrieval-based-Voice-Conversion-WebUI/blob/9f2f0559e6932c10c48642d404e7d2e771d9db43/infer-web.py#L1358
- https://github.com/RVC-Project/Retrieval-based-Voice-Conversion-WebUI/blob/9f2f0559e6932c10c48642d404e7d2e771d9db43/infer-web.py#L1398
Frequently Asked Questions
What is the severity of CVE-2025-43849?
CVE-2025-43849 has a medium severity rating due to its potential for exploitation via unsafe deserialization.
How do I fix CVE-2025-43849?
To fix CVE-2025-43849, upgrade to Retrieval-based Voice Conversion WebUI version 2.2.231007 or later.
What type of vulnerability is CVE-2025-43849?
CVE-2025-43849 is classified as an unsafe deserialization vulnerability that affects user inputs in the framework.
Which versions are affected by CVE-2025-43849?
Retrieval-based Voice Conversion WebUI versions 2.2.231006 and prior are affected by CVE-2025-43849.
Can CVE-2025-43849 lead to remote code execution?
Yes, CVE-2025-43849 can potentially lead to remote code execution if exploited by malicous actors.
- collector/mitre-cve
- source/MITRE
- agent/weakness
- agent/title
- agent/references
- agent/type
- agent/description
- agent/first-publish-date
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- agent/softwarecombine
- agent/author
- agent/severity
- agent/event
- collector/nvd-api
- source/NVD
- agent/last-modified-date
- collector/epss-latest
- source/FIRST
- agent/source
- agent/tags
- agent/epss
- vendor/retrieval-based voice conversion
- canonical/retrieval-based voice conversion voice conversion webui