dbcve.org
Retrieval Based Voice Conversion WebuiApplication · Rvc Project

CVE-2025-43852

CRITICAL · 9.8 CVSS v3.1 Published 2025-05-05
Fix available
A fix is available. Upgrade to after 2.2.231006 or later.
See remediation →
100/100
Remediation priority · Urgent
Remotely reachable No privileges Zero-click

Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.

NVD · unedited
Retrieval-based-Voice-Conversion-WebUI is a voice changing framework based on VITS. Versions 2.2.231006 and prior are vulnerable to unsafe deserialization. The model_choose variable takes user input (e.g. a path to a model) and passes it to the uvr function in vr.py. In uvr , if model_name contains the string "DeEcho", a new instance of AudioPreDeEcho class is created with the model_path attribute containing the aforementioned user input. In the AudioPreDeEcho class, the user input is used to load the model on that path with torch.load, which can lead to unsafe deserialization and remote code execution. As of time of publication, no known patches exist.

Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.

dbcve analysis · high confidence

Retrieval-based-Voice-Conversion-WebUI versions 2.2.231006 and prior contains an unsafe deserialization vulnerability. User-supplied input to the model_choose variable is passed to the uvr function in vr.py, and when the model_name contains 'DeEcho', it creates an AudioPreDeEcho instance using the user input as a model_path. This path is then used directly with torch.load, enabling remote code execution.

MitigationAvoid loading model files from untrusted sources; validate and sanitize all model paths before use; once available, apply vendor patches; consider implementing safe deserialization using torch.load with weights_only=True or a custom secure loader.

Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.

Affected products & versions What the vendor confirmedThe version ranges the vendor confirmed as vulnerable. If your version sits inside a range here, treat yourself as exposed until you have upgraded.

NVD · CPE data
Retrieval Based Voice Conversion WebuiApplication
Affected:<= 2.2.231006

CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.

From the vector
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.

dbcve checks

Work through these to decide whether this CVE applies to you.

  1. Identify installed version of Retrieval-based-Voice-Conversion-WebUI
    Check the version file or metadata in the installation directory. Look for version.py, __init__.py, or similar version indicators. Run: pip show retrieval-based-voice-conversion-webui or check git tags if cloned from repository.
    Affected if Version is 2.2.231006 or any version prior to it.
  2. Locate the vulnerable vr.py file
    Search for the vr.py file in the project. It is typically located in the /content/ directory or the main project root. Check paths like ./vr.py or ./RVC-beta3/vr.py.
    Affected if The file vr.py exists and contains the uvr function that processes model_choose input.
  3. Verify the vulnerable code pattern in uvr function
    Open vr.py and locate the uvr function. Search for code that creates AudioPreDeEcho instances and passes user input directly to torch.load without validation. Look for patterns where model_name contains 'DeEcho' and model_path is user-controlled.
    Affected if The code shows model_choose/model_name input being passed directly to torch.load without sanitization.
  4. Check if DeEcho models can be loaded via web interface
    Determine if the web interface exposes a setting or parameter named model_choose, model_name, or similar that accepts DeEcho as a model type. Test by checking if the application accepts and processes model names containing 'DeEcho'.
    Affected if The application accepts user-supplied model names containing 'DeEcho' and processes them through the vulnerable code path.
  5. Inspect torch.load usage in the DeEcho code path
    In vr.py, locate where AudioPreDeEcho is instantiated. Verify that torch.load is called with the user-provided model_path argument and weights_only is not set to True.
    Affected if torch.load is called with a user-supplied path without weights_only=True or other deserialization protection.

You are affected if you run Retrieval-based-Voice-Conversion-WebUI version 2.2.231006 or earlier and the application can load DeEcho models via user-controlled input that reaches torch.load without sanitization.

Generated from the published advisory. Verify against your own configuration.

Check your environment

Paste your version and any relevant configuration and it will be compared against the affected criteria above. Do not include secrets or credentials.

AI-assisted, checked against the advisory. Informational, not a guarantee.

Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.

From vendor data
Upgrade available Upgrade to a release after 2.2.231006
Interim mitigation

Avoid loading model files from untrusted sources; validate and sanitize all model paths before use; once available, apply vendor patches; consider implementing safe deserialization using torch.load with weights_only=True or a custom secure loader.

Fix this in Retrieval Based Voice Conversion Webui Scoped from the published advisory
  • Consultation5.0 h
  • Implementation10.0 h
  • Testing6.0 h
  • Review / QA3.0 h
24.0 hours of engineering $4,240
Get the upgrade done

An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $6,784.

Scan for this in your stack

Free · runs locally
dbcve dependency scanner

Check whether your project pulls in CVE-2025-43852 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.

Get it on GitHub Scan in the browser

References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.

Primary sources

Practitioner notes

Contributed

Peer-ranked notes from engineers who’ve handled CVE-2025-43852 in production — separate from our analysis above.

No notes yet

Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.

What this is

A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.

What belongs here
  • Verified mitigations, workarounds, and config changes
  • Version or environment caveats, and links to real fixes
  • No weaponised exploit code, or anything meant to cause harm
  • No spam, self-promotion, credentials, or personal data