CVE-2025-43852: GHSL-2025-012_GHSL-2025-022: Multiple vulnerabilities in Retrieval-based-Voice-Conversion-WebUI - CVE-2025-43842_CVE-2025-43852
Retrieval-based-Voice-Conversion-WebUI is a voice changing framework based on VITS. Versions 2.2.231006 and prior are vulnerable to unsafe deserialization. The modelchoose variable takes user input (e.g. a path to a model) and passes it to the uvr function in vr.py. In uvr , if modelname contains the string "DeEcho", a new instance of AudioPreDeEcho class is created with the modelpath attribute containing the aforementioned user input. In the AudioPreDeEcho class, the user input is used to load the model on that path with torch.load, which can lead to unsafe deserialization and remote code execution. As of time of publication, no known patches exist.
Other sources
Retrieval-based-Voice-Conversion-WebUI is vulnerable to commandline injection
— GitHub Security Lab
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-43852?
CVE-2025-43852 is considered a high-severity vulnerability due to its potential for unsafe deserialization.
How do I fix CVE-2025-43852?
To fix CVE-2025-43852, update Retrieval-based Voice Conversion WebUI to a version later than 2.2.231006.
What are the affected versions for CVE-2025-43852?
CVE-2025-43852 affects Retrieval-based Voice Conversion WebUI versions up to and including 2.2.231006.
What type of vulnerability is CVE-2025-43852?
CVE-2025-43852 is a vulnerability related to unsafe deserialization.
What impacts does CVE-2025-43852 have on users?
CVE-2025-43852 can lead to potential code execution risks as it allows for unsafe user input handling.