- Description
- Retrieval-based-Voice-Conversion-WebUI is a voice changing framework based on VITS. Versions 2.2.231006 and prior are vulnerable to unsafe deserialization. The ckpt_path0 variable takes user input (e.g. a path to a model) and passes it to the change_info function in process_ckpt.py, which uses it to load the model on that path with torch.load, which can lead to unsafe deserialization and remote code execution. As of time of publication, no known patches exist.
- Source
- security-advisories@github.com
- NVD status
- Awaiting Analysis
CVSS 4.0
- Type
- Secondary
- Base score
- 8.9
- Impact score
- -
- Exploitability score
- -
- Vector string
- CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- Severity
- HIGH
- security-advisories@github.com
- CWE-502
- Hype score
- Not currently trending
🚨 CVE-2025-43848 🔴 HIGH (8.9) 🏢 RVC-Project - Retrieval-based-Voice-Conversion-WebUI 🏗️ <= 2.2.231006 🔗 https://t.co/KaJuP86HaX 🔗 https://t.co/0KxByl541B 🔗 https://t.co/TccAvayiu3 🔗 https://t.co/TCRZUXcZeY #CyberCron #VulnAlert #InfoSec https://t.co/h
@cybercronai
6 May 2025
7 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
CVE-2025-43848 Retrieval-based-Voice-Conversion-WebUI is a voice changing framework based on VITS. Versions 2.2.231006 and prior are vulnerable to unsafe deserialization. The ckpt_p… https://t.co/VZKMNwSb2K
@CVEnew
5 May 2025
333 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
[CVE-2025-43848: HIGH] Voice Conversion WebUI based on VITS has a vulnerability in versions up to 2.2.231006. An issue with unsafe deserialization in the process_ckpt.py file may lead to remote code executio...#cve,CVE-2025-43848,#cybersecurity https://t.co/RGVNgRZBkO https://t.c
@CveFindCom
5 May 2025
37 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes