CVE-2025-43842 GHSL-2025-012_Retrieval-based-Voice-Conversion-WebUI
Attackers can execute arbitrary commands on the server via user input in the Retrieval-based-Voice-Conversion-WebUI voice changing framework.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-43842?
CVE-2025-43842 is a high-severity command injection vulnerability in RVC-Project Retrieval-based-Voice-Conversion-WebUI, published on 5 May 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Retrieval-based-Voice-Conversion-WebUI is a voice changing framework based on VITS. Versions 2.2.231006 and prior are vulnerable to command injection. The variables exp_dir1, np7, trainset_dir4 and sr2 take user input and pass it to the preprocess_dataset function, which concatenates them into a command that is run on the server. This can lead to arbitrary command execution. As of time of publication, no known patches exist.
Weakness: CWE-77
Which versions are affected by CVE-2025-43842?
It affects 1 product.
Products include Rvc-Project Retrieval-Based-Voice-Conversion-Webui.
How do I fix CVE-2025-43842?
No fix has been published for CVE-2025-43842 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2025-43842 being exploited?
There is no known exploitation of CVE-2025-43842 in the wild and no public exploit code.
Other vulnerabilities in RVC-Project Retrieval-based-Voice-Conversion-WebUI
- CVE-2025-43843 GHSL-2025-013_Retrieval-based-Voice-Conversion-WebUI
- CVE-2025-43844 GHSL-2025-014_Retrieval-based-Voice-Conversion-WebUI
- CVE-2025-43845 GHSL-2025-015_Retrieval-based-Voice-Conversion-WebUI
- CVE-2025-43846 GHSL-2025-016_Retrieval-based-Voice-Conversion-WebUI
- CVE-2025-43847 GHSL-2025-017_Retrieval-based-Voice-Conversion-WebUI