CVE-2025-43850

Retrieval-based-Voice-Conversion-WebUI is a voice changing framework based on VITS. Versions 2.2.231006 and prior are vulnerable to unsafe deserialization. Theckpt_dirvariabletakes user input(e.g. a path to a model) andpassesit to thechange_infofunction inexport.py, which uses it toload the model on that path withtorch.load, which can lead to unsafe deserialization and remote code execution. As of time of publication, no known patches exist.