Unsafe Deserialization in Retrieval-based Voice Conversion Framework by RVC

CVE-2025-43846

What is CVE-2025-43846?

The Retrieval-based Voice Conversion WebUI framework has a vulnerability due to unsafe deserialization in the ckpt_path1 variable. This vulnerability allows user input, specifically a model path, to be passed unvalidated to the show_info function in the process_ckpt.py script. This can lead to remote code execution when torch.load attempts to load a model from that user-specified path. Currently, there are no known patches for this issue, highlighting an urgent need for users to assess their configurations.

References