- Description
- Retrieval-based-Voice-Conversion-WebUI is a voice changing framework based on VITS. Versions 2.2.231006 and prior are vulnerable to unsafe deserialization. The ckpt_path2 variable takes user input (e.g. a path to a model) and passes it to the extract_small_model function in process_ckpt.py, which uses it to load the model on that path with torch.load, which can lead to unsafe deserialization and remote code execution. As of time of publication, no known patches exist.
- Source
- security-advisories@github.com
- NVD status
- Awaiting Analysis
CVSS 4.0
- Type
- Secondary
- Base score
- 8.9
- Impact score
- -
- Exploitability score
- -
- Vector string
- CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- Severity
- HIGH
- security-advisories@github.com
- CWE-502
- Hype score
- Not currently trending
🚨 CVE-2025-43847 🔴 HIGH (8.9) 🏢 RVC-Project - Retrieval-based-Voice-Conversion-WebUI 🏗️ <= 2.2.231006 🔗 https://t.co/KaJuP86HaX 🔗 https://t.co/IrI9B3TsVz 🔗 https://t.co/PYxTWSjXF7 🔗 https://t.co/uDr5PiI9Y2 #CyberCron #VulnAlert #InfoSec https://t.co/G
@cybercronai
7 May 2025
7 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
[CVE-2025-43847: HIGH] Voice Conversion WebUI has a vulnerability in versions prior to 2.2.231006 where user input can trigger unsafe deserialization, allowing remote code execution. No patches available yet.#cve,CVE-2025-43847,#cybersecurity https://t.co/jeVfutJ5zK https://t.co/
@CveFindCom
5 May 2025
35 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes