CVE-2025-43852: GHSL-2025-022_Retrieval-based-Voice-Conversion-WebUI
First published: Mon May 05 2025(Updated: )
Retrieval-based-Voice-Conversion-WebUI is a voice changing framework based on VITS. Versions 2.2.231006 and prior are vulnerable to unsafe deserialization. The model_choose variable takes user input (e.g. a path to a model) and passes it to the uvr function in vr.py. In uvr , if model_name contains the string "DeEcho", a new instance of AudioPreDeEcho class is created with the model_path attribute containing the aforementioned user input. In the AudioPreDeEcho class, the user input is used to load the model on that path with torch.load, which can lead to unsafe deserialization and remote code execution. As of time of publication, no known patches exist.
Credit: security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Retrieval-based Voice Conversion WebUI | <=2.2.231006 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://securitylab.github.com/advisories/GHSL-2025-012_GHSL-2025-022_Retrieval-based-Voice-Conversion-WebUI/
- https://github.com/RVC-Project/Retrieval-based-Voice-Conversion-WebUI/blob/7ef19867780cf703841ebafb565a4e47d1ea86ff/infer/modules/uvr5/vr.py#L214
- https://github.com/RVC-Project/Retrieval-based-Voice-Conversion-WebUI/blob/9f2f0559e6932c10c48642d404e7d2e771d9db43/infer-web.py#L1073
- https://github.com/RVC-Project/Retrieval-based-Voice-Conversion-WebUI/blob/9f2f0559e6932c10c48642d404e7d2e771d9db43/infer-web.py#L1098
Frequently Asked Questions
What is the severity of CVE-2025-43852?
CVE-2025-43852 is considered a high-severity vulnerability due to its potential for unsafe deserialization.
How do I fix CVE-2025-43852?
To fix CVE-2025-43852, update Retrieval-based Voice Conversion WebUI to a version later than 2.2.231006.
What are the affected versions for CVE-2025-43852?
CVE-2025-43852 affects Retrieval-based Voice Conversion WebUI versions up to and including 2.2.231006.
What type of vulnerability is CVE-2025-43852?
CVE-2025-43852 is a vulnerability related to unsafe deserialization.
What impacts does CVE-2025-43852 have on users?
CVE-2025-43852 can lead to potential code execution risks as it allows for unsafe user input handling.
- collector/mitre-cve
- source/MITRE
- agent/weakness
- agent/title
- agent/references
- agent/type
- agent/description
- agent/first-publish-date
- agent/guess-ai
- agent/software-canonical-lookup
- agent/softwarecombine
- agent/author
- agent/severity
- agent/event
- collector/nvd-api
- source/NVD
- agent/last-modified-date
- collector/epss-latest
- source/FIRST
- agent/source
- agent/tags
- agent/epss
- vendor/retrieval-based-voice-conversion-webui
- canonical/retrieval-based voice conversion webui