Command Injection Vulnerability in Retrieval-Based Voice Conversion Framework

CVE-2025-43843

What is CVE-2025-43843?

The Retrieval-Based Voice Conversion WebUI is susceptible to a command injection due to improper handling of user input in specific variables. By manipulating these inputs, an attacker could execute arbitrary commands on the server through the extract_f0_feature function. This vulnerability could potentially compromise the server's integrity, leading to unauthorized actions. As of now, there are no available patches to address this issue.

References