CVE-2025-43852

Retrieval-based-Voice-Conversion-WebUI is a voice changing framework based on VITS. Versions 2.2.231006 and prior are vulnerable to unsafe deserialization. Themodel_choosevariabletakes user input(e.g. a path to a model) andpassesit to theuvrfunction invr.py. Inuvr, ifmodel_namecontains the string"DeEcho", a new instance ofAudioPreDeEchoclass is created with themodel_pathattribute containing the aforementioned user input. In theAudioPreDeEchoclass, the user input is used toload the model on that path withtorch.load, which can lead to unsafe deserialization and remote code execution. As of time of publication, no known patches exist.