Unsafe Deserialization in Retrieval-based Voice Conversion WebUI by RVC-Project

CVE-2025-43847

What is CVE-2025-43847?

The Retrieval-based Voice Conversion WebUI, particularly versions up to 2.2.231006, contains a vulnerability that arises from the handling of user input through the 'ckpt_path2' variable. This variable can be exploited as it is directly passed to the 'extract_small_model' function, which leverages 'torch.load' to load models from the specified paths. This functionality is susceptible to unsafe deserialization, potentially allowing attackers to execute remote code by crafting malicious inputs. Currently, no patches have been released to address this vulnerability.

References