Command Injection Vulnerability in Retrieval-based Voice Conversion Framework by RVC Project

CVE-2025-43842

What is CVE-2025-43842?

The Retrieval-based Voice Conversion WebUI framework versions 2.2.231006 and earlier are vulnerable to a command injection attack due to improper handling of user inputs. Specific variables—exp_dir1, np7, trainset_dir4, and sr2—accept user data and pass it to the preprocess_dataset function, which then creates a command that executes on the server. This flaw could lead to unauthorized arbitrary command execution, posing a significant risk to users of the platform. As of the latest information, there are no known patches available.

References