CVE-2025-43850: GHSL-2025-020_Retrieval-based-Voice-Conversion-WebUI
First published: Mon May 05 2025(Updated: )
Retrieval-based-Voice-Conversion-WebUI is a voice changing framework based on VITS. Versions 2.2.231006 and prior are vulnerable to unsafe deserialization. The ckpt_dir variable takes user input (e.g. a path to a model) and passes it to the change_info function in export.py, which uses it to load the model on that path with torch.load, which can lead to unsafe deserialization and remote code execution. As of time of publication, no known patches exist.
Credit: security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Retrieval-based Voice Conversion Voice Conversion WebUI | <2.2.231006 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://securitylab.github.com/advisories/GHSL-2025-012_GHSL-2025-022_Retrieval-based-Voice-Conversion-WebUI/
- https://github.com/RVC-Project/Retrieval-based-Voice-Conversion-WebUI/blob/7ef19867780cf703841ebafb565a4e47d1ea86ff/infer/modules/onnx/export.py#L7
- https://github.com/RVC-Project/Retrieval-based-Voice-Conversion-WebUI/blob/9f2f0559e6932c10c48642d404e7d2e771d9db43/infer-web.py#L1495
- https://github.com/RVC-Project/Retrieval-based-Voice-Conversion-WebUI/blob/9f2f0559e6932c10c48642d404e7d2e771d9db43/infer-web.py#L1505
Frequently Asked Questions
What is the severity of CVE-2025-43850?
CVE-2025-43850 has a high severity rating due to the risk of unsafe deserialization that could lead to remote code execution.
How do I fix CVE-2025-43850?
To mitigate CVE-2025-43850, upgrade the Retrieval-based Voice Conversion WebUI to version 2.2.231007 or higher.
What versions are affected by CVE-2025-43850?
CVE-2025-43850 affects versions of Retrieval-based Voice Conversion WebUI up to and including version 2.2.231006.
What is unsafe deserialization in the context of CVE-2025-43850?
Unsafe deserialization in CVE-2025-43850 allows attackers to exploit user input, potentially executing arbitrary code when the application processes the input.
What is the impact of CVE-2025-43850 on users?
The impact of CVE-2025-43850 includes potential remote code execution, which can compromise system integrity and lead to unauthorized access.
- collector/mitre-cve
- source/MITRE
- agent/weakness
- agent/title
- agent/references
- agent/type
- agent/first-publish-date
- agent/description
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- agent/softwarecombine
- agent/author
- agent/severity
- agent/event
- collector/nvd-api
- source/NVD
- agent/last-modified-date
- collector/epss-latest
- source/FIRST
- agent/source
- agent/tags
- agent/epss
- vendor/retrieval-based voice conversion
- canonical/retrieval-based voice conversion voice conversion webui