Command injection vulnerabilities in Retrieval-based-Voice-Conversion-WebUI
GitHub Security Lab discovered multiple command injection vulnerabilities in Retrieval-based-Voice-Conversion-WebUI that allow arbitrary command execution through unsanitized user input. The vulnerabilities were assigned CVE-2025-43842 and CVE-2025-43852 after 90 days of coordinated disclosure.
What happened
Retrieval-based-Voice-Conversion-WebUI version 2.2.231006 contains command injection vulnerabilities in the infer-web.py file. Variables exp_dir, np, trainset_dir, sr and f0method take user input and concatenate them into system commands without sanitization, allowing arbitrary command execution.
Reported impact
The vulnerabilities may lead to arbitrary command execution on the server running the application.
Index analysis
GitHub Security Lab identified two instances of command injection: in the preprocess_dataset function and the extract_f0_feature function. The extract_f0_feature function contains multiple vulnerable command constructions that would all require fixing to prevent command injection.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.