PT-2025-19739 · Unknown · Retrieval-Based-Voice-Conversion-Webui

Sylwia Budzynska · Published 2025-05-05 · Updated 2025-08-01 · CVE-2025-43843

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Retrieval-based-Voice-Conversion-WebUI versions 2.2.231006 and prior

Description Retrieval-based-Voice-Conversion-WebUI is a voice changing framework based on VITS. The variables exp dir1, np7, and f0method8 take user input and pass it into the extract f0 feature function, which concatenates them into a command that is run on the server. This can lead to arbitrary command execution. As of the time of publication, no known patches exist.

Recommendations For versions 2.2.231006 and prior, as a temporary workaround, consider restricting the input to the variables exp dir1, np7, and f0method8 to prevent malicious commands from being executed. Additionally, consider disabling the extract f0 feature function until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

CVE-2025-43843

Affected Products

Retrieval-Based-Voice-Conversion-Webui

References · 17

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/43xxx/CVE-2025-43843.json · Exploit
• https://securitylab.github.com/advisories/GHSL-2025-012_GHSL-2025-022_Retrieval-based-Voice-Conversion-WebUI · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-43843 · Security Note
• https://osv.dev/vulnerability/CVE-2025-43843 · Vendor Advisory
• https://github.com/RVC-Project/Retrieval-based-Voice-Conversion-WebUI/blob/7ef19867780cf703841ebafb565a4e47d1ea86ff/infer-web.py#L265-L274 · Note
• https://github.com/RVC-Project/Retrieval-based-Voice-Conversion-WebUI/blob/7ef19867780cf703841ebafb565a4e47d1ea86ff/infer-web.py#L330-L332 · Note
• https://github.com/RVC-Project/Retrieval-based-Voice-Conversion-WebUI/blob/7ef19867780cf703841ebafb565a4e47d1ea86ff/infer-web.py#L307-L309 · Note
• https://github.com/RVC-Project/Retrieval-based-Voice-Conversion-WebUI/blob/7ef19867780cf703841ebafb565a4e47d1ea86ff/infer-web.py#L373-L375 · Note
• https://github.com/RVC-Project/Retrieval-based-Voice-Conversion-WebUI/blob/7ef19867780cf703841ebafb565a4e47d1ea86ff/infer-web.py#L276-L278 · Note
• https://github.com/RVC-Project/Retrieval-based-Voice-Conversion-WebUI/blob/7ef19867780cf703841ebafb565a4e47d1ea86ff/infer-web.py#L1276-L1289 · Note
• https://twitter.com/VulmonFeeds/status/1919458852342288491 · Twitter Post
• https://t.me/cveNotify/130575 · Telegram Post
• https://twitter.com/CveFindCom/status/1919445428015145214 · Twitter Post
• https://twitter.com/cybercronai/status/1920107700496560622 · Twitter Post
• https://t.me/cvetracker/23053 · Telegram Post