CVE-2025-43850: GHSL-2025-012_GHSL-2025-022: Multiple vulnerabilities in Retrieval-based-Voice-Conversion-WebUI - CVE-2025-43842_CVE-2025-43852
Retrieval-based-Voice-Conversion-WebUI is a voice changing framework based on VITS. Versions 2.2.231006 and prior are vulnerable to unsafe deserialization. The ckptdir variable takes user input (e.g. a path to a model) and passes it to the changeinfo function in export.py, which uses it to load the model on that path with torch.load, which can lead to unsafe deserialization and remote code execution. As of time of publication, no known patches exist.
Other sources
Retrieval-based-Voice-Conversion-WebUI is vulnerable to commandline injection
— GitHub Security Lab
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-43850?
CVE-2025-43850 has a high severity rating due to the risk of unsafe deserialization that could lead to remote code execution.
How do I fix CVE-2025-43850?
To mitigate CVE-2025-43850, upgrade the Retrieval-based Voice Conversion WebUI to version 2.2.231007 or higher.
What versions are affected by CVE-2025-43850?
CVE-2025-43850 affects versions of Retrieval-based Voice Conversion WebUI up to and including version 2.2.231006.
What is unsafe deserialization in the context of CVE-2025-43850?
Unsafe deserialization in CVE-2025-43850 allows attackers to exploit user input, potentially executing arbitrary code when the application processes the input.
What is the impact of CVE-2025-43850 on users?
The impact of CVE-2025-43850 includes potential remote code execution, which can compromise system integrity and lead to unauthorized access.