Unsafe Deserialization Vulnerability in Retrieval-based Voice Conversion Framework by RVC-Project

CVE-2025-43849

What is CVE-2025-43849?

The Retrieval-based Voice Conversion WebUI, utilizing a voice changing framework based on VITS, is susceptible to unsafe deserialization issues. Specifically, the variables ckpt_a and cpkt_b, which receive user input such as model paths, can lead to unsafe model loading through the merge function found in process_ckpt.py. This flaw permits remote code execution when the paths are rendered from potentially malicious sources. As of publication, there are no known patches available to mitigate this vulnerability.

References