CVE-2025-43845
Published: 05 May 2025
Summary
CVE-2025-43845 is a high-severity Code Injection (CWE-94) vulnerability in Rvc-Project Retrieval-Based-Voice-Conversion-Webui. Its CVSS base score is 8.9 (High).
Operationally, ranked in the top 16.4% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
Retrieval-based-Voice-Conversion-WebUI, a voice conversion framework based on VITS, contains a code injection vulnerability in versions 2.2.231006 and earlier. The flaw resides in the handling of the ckpt_path2 variable within infer-web.py, where untrusted user input is accepted as a model path, rewritten by the change_info_ function to reference a train.log file, read, and then passed directly to Python's eval function.
An unauthenticated remote attacker can supply a crafted path to trigger arbitrary code execution. Because the application performs no sanitization or sandboxing on the file contents before evaluation, an attacker who can influence or place content at the resolved train.log location can execute commands with the privileges of the web application process, resulting in full system compromise.
The associated GitHub Security Lab advisory GHSL-2025-012 details the vulnerable code paths at the referenced lines in infer-web.py and confirms that no official patches have been released. The reported EPSS scores remain low, with a current value of 0.0189 and a modest peak of 0.0221.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-13507
Vulnerability details
Retrieval-based-Voice-Conversion-WebUI is a voice changing framework based on VITS. Versions 2.2.231006 and prior are vulnerable to code injection. The ckpt_path2 variable takes user input (e.g. a path to a model) and passes it to change_info_ function, which opens and reads…
more
the file on the given path (except it changes the final on the path to train.log), and passes the contents of the file to eval, which can lead to remote code execution. As of time of publication, no known patches exist.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Makes persistent code injection into loaded programs impossible when the executable image itself resides on hardware-protected read-only media.
Dynamically generated code can be produced and executed inside the isolated chamber, preventing host compromise from code-injection payloads.
Validates inputs used in dynamic code generation to block injected directives.
Directly prevents execution of attacker-supplied code written into data memory regions.