CVE-2025-43851: GHSL-2025-021_Retrieval-based-Voice-Conversion-WebUI
First published: Mon May 05 2025(Updated: )
Retrieval-based-Voice-Conversion-WebUI is a voice changing framework based on VITS. Versions 2.2.231006 and prior are vulnerable to unsafe deserialization. The model_choose variable takes user input (e.g. a path to a model) and passes it to the uvr function in vr.py. In uvr , a new instance of AudioPre class is created with the model_path attribute containing the aformentioned user input. In the AudioPre class, the user input, is used to load the model on that path with torch.load, which can lead to unsafe deserialization and remote code execution. As of time of publication, no known patches exist.
Credit: security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Retrieval-based Voice Conversion WebUI | <2.2.231006 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://securitylab.github.com/advisories/GHSL-2025-012_GHSL-2025-022_Retrieval-based-Voice-Conversion-WebUI/
- https://github.com/RVC-Project/Retrieval-based-Voice-Conversion-WebUI/blob/7ef19867780cf703841ebafb565a4e47d1ea86ff/infer/modules/onnx/export.py#L7
- https://github.com/RVC-Project/Retrieval-based-Voice-Conversion-WebUI/blob/9f2f0559e6932c10c48642d404e7d2e771d9db43/infer-web.py#L1073
- https://github.com/RVC-Project/Retrieval-based-Voice-Conversion-WebUI/blob/9f2f0559e6932c10c48642d404e7d2e771d9db43/infer-web.py#L1098
Frequently Asked Questions
What is the severity of CVE-2025-43851?
CVE-2025-43851 is classified as a high severity vulnerability due to its potential for remote code execution.
How do I fix CVE-2025-43851?
To fix CVE-2025-43851, upgrade to version 2.2.231007 or later of the Retrieval-based Voice Conversion WebUI.
What is the impact of CVE-2025-43851?
The impact of CVE-2025-43851 includes the risk of an attacker exploiting unsafe deserialization to execute arbitrary code.
Which versions are affected by CVE-2025-43851?
CVE-2025-43851 affects versions 2.2.231006 and prior of the Retrieval-based Voice Conversion WebUI.
Where can I find more information about CVE-2025-43851?
More information about CVE-2025-43851 can be found in the security advisory for the Retrieval-based Voice Conversion WebUI.
- collector/mitre-cve
- source/MITRE
- agent/weakness
- agent/title
- agent/references
- agent/type
- agent/description
- agent/first-publish-date
- agent/guess-ai
- agent/software-canonical-lookup
- agent/softwarecombine
- agent/author
- agent/severity
- agent/event
- collector/nvd-api
- source/NVD
- agent/last-modified-date
- collector/epss-latest
- source/FIRST
- agent/source
- agent/tags
- agent/epss
- vendor/retrieval-based-voice-conversion-webui
- canonical/retrieval-based voice conversion webui