CVE-2025-43851: GHSL-2025-012_GHSL-2025-022: Multiple vulnerabilities in Retrieval-based-Voice-Conversion-WebUI - CVE-2025-43842_CVE-2025-43852
Retrieval-based-Voice-Conversion-WebUI is a voice changing framework based on VITS. Versions 2.2.231006 and prior are vulnerable to unsafe deserialization. The modelchoose variable takes user input (e.g. a path to a model) and passes it to the uvr function in vr.py. In uvr , a new instance of AudioPre class is created with the modelpath attribute containing the aformentioned user input. In the AudioPre class, the user input, is used to load the model on that path with torch.load, which can lead to unsafe deserialization and remote code execution. As of time of publication, no known patches exist.
Other sources
Retrieval-based-Voice-Conversion-WebUI is vulnerable to commandline injection
— GitHub Security Lab
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-43851?
CVE-2025-43851 is classified as a high severity vulnerability due to its potential for remote code execution.
How do I fix CVE-2025-43851?
To fix CVE-2025-43851, upgrade to version 2.2.231007 or later of the Retrieval-based Voice Conversion WebUI.
What is the impact of CVE-2025-43851?
The impact of CVE-2025-43851 includes the risk of an attacker exploiting unsafe deserialization to execute arbitrary code.
Which versions are affected by CVE-2025-43851?
CVE-2025-43851 affects versions 2.2.231006 and prior of the Retrieval-based Voice Conversion WebUI.
Where can I find more information about CVE-2025-43851?
More information about CVE-2025-43851 can be found in the security advisory for the Retrieval-based Voice Conversion WebUI.