CVE-2025-43845
Last modified
CVE-2025-43845 is a critical-severity vulnerability rated 9.8/10 on the CVSS scale. Retrieval-based-Voice-Conversion-WebUI is a voice changing framework based on VITS. Versions 2.2.231006 and prior are vulnerable to code injection. EPSS estimates a 0.79% chance of exploitation in the next 30 days.
Description
Retrieval-based-Voice-Conversion-WebUI is a voice changing framework based on VITS. Versions 2.2.231006 and prior are vulnerable to code injection. The ckpt_path2 variable takes user input (e.g. a path to a model) and passes it to change_info_ function, which opens and reads the file on the given path (except it changes the final on the path to train.log), and passes the contents of the file to eval, which can lead to remote code execution. As of time of publication, no known patches exist.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Rvc-Project | Retrieval-Based-Voice-Conversion-Webui | <= 2.2.231006 |
References
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2025-43845?
How severe is CVE-2025-43845?
How do I fix CVE-2025-43845?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2025
- CVE-2025-4384The MQTT add-on of PcVue fails to verify that a remote devic…6
- CVE-2025-43840Cross-Site Request Forgery (CSRF) vulnerability in ref Check…7.1
- CVE-2025-43841Improper Neutralization of Input During Web Page Generation …6.5
- CVE-2025-43842Retrieval-based-Voice-Conversion-WebUI is a voice changing f…9.8
- CVE-2025-43843Retrieval-based-Voice-Conversion-WebUI is a voice changing f…9.8
- CVE-2025-43844Retrieval-based-Voice-Conversion-WebUI is a voice changing f…9.8
- CVE-2025-43846Retrieval-based-Voice-Conversion-WebUI is a voice changing f…9.8
- CVE-2025-43847Retrieval-based-Voice-Conversion-WebUI is a voice changing f…9.8
- CVE-2025-43848Retrieval-based-Voice-Conversion-WebUI is a voice changing f…9.8
- CVE-2025-43849Retrieval-based-Voice-Conversion-WebUI is a voice changing f…9.8
- CVE-2025-43850Retrieval-based-Voice-Conversion-WebUI is a voice changing f…9.8
- CVE-2025-43851Retrieval-based-Voice-Conversion-WebUI is a voice changing f…9.8
Are you affected by CVE-2025-43845?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST