AVID-2026-R1698

Description

GHSL-2025-013_Retrieval-based-Voice-Conversion-WebUI (CVE-2025-43843)

Details

Retrieval-based-Voice-Conversion-WebUI is a voice changing framework based on VITS. Versions 2.2.231006 and prior are vulnerable to command injection. The variables exp_dir1, np7 and f0method8 take user input and pass it into the extract_f0_feature function, which concatenates them into a command that is run on the server. This can lead to arbitrary command execution. As of time of publication, no known patches exist.

Reason for inclusion in AVID: CVE-2025-43843 describes a remote command injection (RCE) vulnerability in the Retrieval-based-Voice-Conversion-WebUI, an AI/ML-focused web UI for voice conversion. It affects a software component used in AI pipelines (RVC-Project), enabling execution of arbitrary commands on the server. This is clearly an AI-related software vulnerability within the AI stack, relevant to the software supply chain (dependencies/tools used to deploy AI systems). The report provides specific vulnerability details, affected versions, and evidence (CVE/NVD references, code references), satisfying sufficient_evidence. No hardware/firmware-only aspects are involved.

References

• NVD entry
• https://securitylab.github.com/advisories/GHSL-2025-012_GHSL-2025-022_Retrieval-based-Voice-Conversion-WebUI/
• https://github.com/RVC-Project/Retrieval-based-Voice-Conversion-WebUI/blob/7ef19867780cf703841ebafb565a4e47d1ea86ff/infer-web.py#L1276-L1289
• https://github.com/RVC-Project/Retrieval-based-Voice-Conversion-WebUI/blob/7ef19867780cf703841ebafb565a4e47d1ea86ff/infer-web.py#L265-L274
• https://github.com/RVC-Project/Retrieval-based-Voice-Conversion-WebUI/blob/7ef19867780cf703841ebafb565a4e47d1ea86ff/infer-web.py#L276-L278
• https://github.com/RVC-Project/Retrieval-based-Voice-Conversion-WebUI/blob/7ef19867780cf703841ebafb565a4e47d1ea86ff/infer-web.py#L307-L309
• https://github.com/RVC-Project/Retrieval-based-Voice-Conversion-WebUI/blob/7ef19867780cf703841ebafb565a4e47d1ea86ff/infer-web.py#L330-L332
• https://github.com/RVC-Project/Retrieval-based-Voice-Conversion-WebUI/blob/7ef19867780cf703841ebafb565a4e47d1ea86ff/infer-web.py#L373-L375

Affected or Relevant Artifacts

• Developer: RVC-Project
• Deployer: RVC-Project
• Artifact Details:

Impact

AVID Taxonomy Categorization

• Risk domains: Security
• SEP subcategories: S0100: Software Vulnerability
• Lifecycle stages: L06: Deployment

CWE

Other information

• Report Type: Advisory
• Credits:
• Date Reported: 2025-05-05
• Version: 0.3.3
• AVID Entry