CVE-2025-43843highCWE-77

CVE-2025-43843: high-severity vulnerability in RVC-Project Retrieval-based-Voice-Conversion-We…

GHSL-2025-013_Retrieval-based-Voice-Conversion-WebUI

Published

Follow this CVE+ Monitor Retrieval-based-Voice-Conversion-WebUI

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 8.9epss 2.4%
Retrieval-based-Voice-Conversion-WebUI is a voice changing framework based on VITS. Versions 2.2.231006 and prior are vulnerable to command injection. The variables exp_dir1, np7 and f0method8 take user input and pass it into the extract_f0_feature function, which concatenates them into a command that is run on the server. This can lead to arbitrary command execution. As of time of publication, no known patches exist.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
Affected products
RVC-Project · Retrieval-based-Voice-Conversion-WebUI
Related CVEs — RVC-Project Retrieval-based-Voice-Conversion-We…

In the same product, most dangerous first.

CVE-2025-43844HIGHGHSL-2025-014_Retrieval-based-Voice-Conversion-WebUIEPSS 2.2%CVE-2025-43842HIGHGHSL-2025-012_Retrieval-based-Voice-Conversion-WebUIEPSS 2.2%CVE-2025-43852HIGHGHSL-2025-022_Retrieval-based-Voice-Conversion-WebUIEPSS 1.0%CVE-2025-43851HIGHGHSL-2025-021_Retrieval-based-Voice-Conversion-WebUIEPSS 1.0%CVE-2025-43845HIGHGHSL-2025-015_Retrieval-based-Voice-Conversion-WebUIEPSS 1.0%CVE-2025-43848HIGHGHSL-2025-018_Retrieval-based-Voice-Conversion-WebUIEPSS 1.0%