CVE-2025-43849: GHSL-2025-012_GHSL-2025-022: Multiple vulnerabilities in Retrieval-based-Voice-Conversion-WebUI - CVE-2025-43842_CVE-2025-43852
Retrieval-based-Voice-Conversion-WebUI is a voice changing framework based on VITS. Versions 2.2.231006 and prior are vulnerable to unsafe deserialization. The ckpta and cpktb variables take user input (e.g. a path to a model) and pass it to the merge function in processckpt.py, which uses them to load the models on those paths with torch.load, which can lead to unsafe deserialization and remote code execution. As of time of publication, no known patches exist.
Other sources
Retrieval-based-Voice-Conversion-WebUI is vulnerable to commandline injection
— GitHub Security Lab
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-43849?
CVE-2025-43849 has a medium severity rating due to its potential for exploitation via unsafe deserialization.
How do I fix CVE-2025-43849?
To fix CVE-2025-43849, upgrade to Retrieval-based Voice Conversion WebUI version 2.2.231007 or later.
What type of vulnerability is CVE-2025-43849?
CVE-2025-43849 is classified as an unsafe deserialization vulnerability that affects user inputs in the framework.
Which versions are affected by CVE-2025-43849?
Retrieval-based Voice Conversion WebUI versions 2.2.231006 and prior are affected by CVE-2025-43849.
Can CVE-2025-43849 lead to remote code execution?
Yes, CVE-2025-43849 can potentially lead to remote code execution if exploited by malicous actors.