Unsafe Deserialization in Retrieval-based Voice Conversion Framework by RVC Project

CVE-2025-43851

What is CVE-2025-43851?

The Retrieval-based Voice Conversion WebUI, developed by RVC Project, is susceptible to unsafe deserialization due to the handling of user input in the model_choose variable. This vulnerability allows malicious actors to manipulate the input path to a model. As this input is subsequently passed to the uvr function in vr.py, it leads to the instantiation of the AudioPre class, where the user-defined model_path is processed with torch.load. Such handling can facilitate remote code execution, posing significant security risks. Currently, no patches are available for affected versions.

References