Command Injection Vulnerability in Retrieval-based Voice Conversion Framework by RVC Project

CVE-2025-43844

What is CVE-2025-43844?

The Retrieval-based Voice Conversion WebUI framework, particularly in versions 2.2.231006 and earlier, is susceptible to a command injection vulnerability. User input to variables such as exp_dir1 is improperly handled, allowing malicious commands to be executed on the server through the click_train function. This exposes the system to potential arbitrary command execution risks. As of the latest available information, no patches have been released to mitigate this vulnerability, emphasizing the need for immediate attention from users to prevent exploitation.

References