AVID-2026-R1697

Description

GHSL-2025-012_Retrieval-based-Voice-Conversion-WebUI (CVE-2025-43842)

Details

Retrieval-based-Voice-Conversion-WebUI is a voice changing framework based on VITS. Versions 2.2.231006 and prior are vulnerable to command injection. The variables exp_dir1, np7, trainset_dir4 and sr2 take user input and pass it to the preprocess_dataset function, which concatenates them into a command that is run on the server. This can lead to arbitrary command execution. As of time of publication, no known patches exist.

Reason for inclusion in AVID: CVE-2025-43842 affects Retrieval-based-Voice-Conversion-WebUI, an AI/ML framework, via a command injection vulnerability where user-controlled inputs are passed to a command executor. This is a software vulnerability in a component used to build/deploy AI systems, representing a software supply-chain issue in AI pipelines. The report provides explicit vulnerability details and references (CWE-77, NVD, GitHub code references).

References

Affected or Relevant Artifacts

Developer: RVC-Project
Deployer: RVC-Project
Artifact Details:

Type	Name
System	Retrieval-based-Voice-Conversion-WebUI

Impact

AVID Taxonomy Categorization

Risk domains: Security
SEP subcategories: S0100: Software Vulnerability
Lifecycle stages: L06: Deployment

CWE

ID	Description
CWE-77	CWE-77: Improper Neutralization of Special Elements used in a Command (‘Command Injection’)

Other information

Report Type: Advisory
Credits:
Date Reported: 2025-05-05
Version: 0.3.3
AVID Entry