CVE-2025-43843 is a critical (CVSS 9.8) command injection flaw in Retrieval-based-Voice-Conversion-WebUI versions 2.2.231006 and earlier, in the extract_f0_feature function. Input from the web interface is joined into a command that runs on the server. The record says no known patch exists, so keep the WebUI off untrusted networks.
What's affected
The record lists Retrieval-based-Voice-Conversion-WebUI, a voice changing framework based on VITS, in versions 2.2.231006 and prior. The affected function is extract_f0_feature, and the variables exp_dir1, np7 and f0method8 take user input.
The record says that as of publication no known patches exist. GitHub Security Lab, which found the issues, says it asked the project for a vulnerability contact in January 2025 and was told that the repository was not fully active. It assigned CVEs after its 90 day disclosure period. Check the project's repository for any later commit before you assume it is still unfixed.
GitHub Security Lab notes that the commands are run several times inside this function, and that all of them would have to be fixed to prevent injection. A partial patch would leave the problem in place.
How to check if you're exposed
Find out whether you or your team run this project. Search developer machines, notebooks and GPU servers for a checkout of the repository or a container image built from it. Look for the file infer-web.py, which is the web interface entry point named in the record.
If you find a copy, check its commit and version against 2.2.231006. From the checkout directory, the command git log -1 shows the current commit. Then check where it is listening. The WebUI is a local tool by design, and running it on a network address with no authentication makes it an internet facing command runner.
Check firewall rules and cloud security groups for the port the WebUI uses. Review process lists for long running python processes started from the project folder.
What to do now
- Search for copies of the project on workstations, servers and in container registries.
- Stop the WebUI wherever it is exposed beyond localhost, and bind it to 127.0.0.1 or put authentication in front of it.
- Check the repository for a newer commit that addresses the advisory, and move to it if one exists.
- Run it in a container or virtual machine with no credentials, no cloud tokens and limited network access.
- Remove shared secrets and API keys from the environment of the account that runs it.
- Consider a maintained alternative if the project stays inactive.
Why it matters
The class is command injection, CWE-77 (Command Injection). The function extract_f0_feature builds a command line by concatenating user supplied values, then runs it on the server. Special characters in those values can end the intended command and begin another. This post stays at the level the advisory does, because the point for defenders is where the unsafe handling is and how to remove exposure.
Machine learning tools are often built to run on a researcher's own machine and are then shared with a web interface for convenience. That convenience changes the threat model. A tool that was safe on localhost becomes a remote command runner when it is started with a public address, and many are. The vector shows network access, low complexity, no privileges and no user interaction.
The record does not say the flaw is exploited in the wild, and it is not on the CISA Known Exploited Vulnerabilities list. With no known patch and a project described as not fully active, the safe response is to control exposure rather than wait for a fix.
Quick check
Is there a patched version?
The record says no known patches exist at publication. Check the project repository for newer commits and treat any copy as untrusted until you do.
Is this only a risk if the WebUI is exposed to the internet?
Exposure raises the risk most. Anyone who can reach the interface, including other users on a shared network, can use the described path, so binding it to localhost matters.
Sources
Last reviewed: 18 October 2026.
