Code Injection Vulnerability in Retrieval-based Voice Conversion Framework by RVC-Project

CVE-2025-43845

What is CVE-2025-43845?

The Retrieval-based Voice Conversion WebUI is susceptible to a code injection vulnerability where the ckpt_path2 variable accepts user input for model paths. This input is subsequently employed in the change_info_ function, which reads that file and attempts to execute its content via eval. This flaw potentially enables an attacker to execute arbitrary code remotely by manipulating the input, thereby compromising the integrity and security of the application. As of now, no patches are available to remediate this vulnerability. Users should proceed with caution and look for future updates from the vendor.

References