Skip to content
Submit incident
AII-1001-92513
ConfirmedA court, a regulator or the organization itself has stated the core facts, or the record cites a court or regulator source.

Command injection in Retrieval-based-Voice-Conversion-WebUI extract_f0_feature

GitHub Security Lab identified a command injection vulnerability in the extract_f0_feature function of Retrieval-based-Voice-Conversion-WebUI that could enable arbitrary command execution through unsanitized user input. The vulnerability was assigned CVE-2025-43843 following a coordinated disclosure process.

23 April 2025 · RVC-Project · Security and cyberattacks
23 April 2025

Drafted by Raidu Incident Detection, an automated system.

AII-1001-92513View source ↗
Quick facts
Category
Security and cyberattacks
Source
securitylab.github.com
Date
23 April 2025
Drafted by
Raidu Incident Detection

What happened

The extract_f0_feature function in infer-web.py concatenates user input variables exp_dir, np, and f0method into commands that are executed on the server without proper sanitization, enabling command injection attacks.

Reported impact

The vulnerability may lead to arbitrary command execution on systems running the affected software.

Index analysis

GitHub Security Lab identified the issue as CWE-77: Improper Neutralization of Special Elements used in a Command, with multiple command execution points in the extract_f0_feature function that would all require fixing to prevent the vulnerability.

Classification

Category
Security and cyberattacks
Harm status
Potential harm
Intent
Unintentional
Timing
Unknown
Harm types
Other
AI systems
Retrieval-based-Voice-Conversion-WebUI

Sources and evidence

This record was researched and written by the Index, based on the following original reporting.

securitylab.github.com
https://securitylab.github.com/advisories/GHSL-2025-012_GHSL-2025-022_Retrieval-based-Voice-Conversion-WebUI/