Unsafe Deserialization Vulnerability in Retrieval-based Voice Conversion Framework by RVC Project

CVE-2025-43848

What is CVE-2025-43848?

The Retrieval-based Voice Conversion WebUI framework, a voice-changing tool built on VITS, has a significant security flaw in its handling of user inputs. Specifically, the variable ckpt_path0 accepts input that specifies a path to a model, which is then processed by the change_info function in process_ckpt.py. This mechanism allows for the loading of models via torch.load, potentially facilitating unsafe deserialization and enabling remote code execution. As of now, no patches have been released to address this security issue, leaving affected versions open to exploitation.

References