CVE-2025-43851

Retrieval-based-Voice-Conversion-WebUI is a voice changing framework based on VITS. Versions 2.2.231006 and prior are vulnerable to unsafe deserialization. Themodel_choosevariabletakes user input(e.g. a path to a model) andpassesit to theuvrfunction invr.py. Inuvr, a new instance ofAudioPreclass is created with themodel_pathattribute containing the aformentioned user input. In theAudioPreclass, the user input, is used toload the model on that path withtorch.load, which can lead to unsafe deserialization and remote code execution. As of time of publication, no known patches exist.