PT-2025-19765 · Unknown · Retrieval-Based-Voice-Conversion-Webui

Sylwia Budzynska + 1 · Published 2025-05-05 · Updated 2025-08-01 · CVE-2025-43850

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Retrieval-based-Voice-Conversion-WebUI versions 2.2.231006 and prior

Description Retrieval-based-Voice-Conversion-WebUI is a voice changing framework based on VITS. The issue arises from unsafe deserialization. The ckpt dir variable takes user input, such as a path to a model, and passes it to the change info function in export.py. This function uses torch.load to load the model from the provided path, which can lead to unsafe deserialization and remote code execution. As of the time of publication, no known patches exist.

Recommendations For versions 2.2.231006 and prior, consider disabling the change info function in export.py or restricting user input for the ckpt dir variable to prevent unsafe deserialization until a patch is available. Avoid using the ckpt dir variable in the affected export.py file until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2025-43850

Affected Products

Retrieval-Based-Voice-Conversion-Webui

References · 14

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/43xxx/CVE-2025-43850.json · Exploit
• https://securitylab.github.com/advisories/GHSL-2025-012_GHSL-2025-022_Retrieval-based-Voice-Conversion-WebUI · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-43850 · Security Note
• https://osv.dev/vulnerability/CVE-2025-43850 · Vendor Advisory
• https://github.com/RVC-Project/Retrieval-based-Voice-Conversion-WebUI/blob/9f2f0559e6932c10c48642d404e7d2e771d9db43/infer-web.py#L1505 · Note
• https://github.com/RVC-Project/Retrieval-based-Voice-Conversion-WebUI/blob/7ef19867780cf703841ebafb565a4e47d1ea86ff/infer/modules/onnx/export.py#L7 · Note
• https://github.com/RVC-Project/Retrieval-based-Voice-Conversion-WebUI/blob/9f2f0559e6932c10c48642d404e7d2e771d9db43/infer-web.py#L1495 · Note
• https://t.me/cvedetector/24488 · Telegram Post
• https://twitter.com/CVEnew/status/1919465741075591179 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1919579145576513709 · Twitter Post
• https://t.me/latest_high_impact_cve/2274 · Telegram Post
• https://t.me/cveNotify/130582 · Telegram Post
• https://twitter.com/CveFindCom/status/1919460477903466508 · Twitter Post
• https://twitter.com/cybercronai/status/1920056510966583740 · Twitter Post