CVE-2025-43845 is a critical (CVSS 9.8) code injection flaw in Retrieval-based-Voice-Conversion-WebUI 2.2.231006 and earlier. The change_info_ function reads a file chosen by the user and passes its contents to eval, which can lead to remote code execution. The record says no known patch exists, so keep the WebUI off untrusted networks.
What's affected
The record lists Retrieval-based-Voice-Conversion-WebUI, a voice changing framework based on VITS, in versions 2.2.231006 and prior. The affected function is change_info_, and the variable ckpt_path2 takes user input.
The record says that as of publication no known patches exist. GitHub Security Lab, which found the issues, says it asked the project for a vulnerability contact in January 2025 and was told that the repository was not fully active. It assigned CVEs after its 90 day disclosure period. Check the project's repository for any later commit before you assume it is still unfixed.
The record explains the path. The ckpt_path2 variable takes user input, such as a path to a model, and passes it to the change_info_ function. That function opens and reads the file at the path, with the final component changed to train.log, and passes the contents to eval.
How to check if you're exposed
Find out whether you or your team run this project. Search developer machines, notebooks and GPU servers for a checkout of the repository or a container image built from it. Look for the file infer-web.py, which is the web interface entry point named in the record.
If you find a copy, check its commit and version against 2.2.231006. From the checkout directory, the command git log -1 shows the current commit. Then check where it is listening. The WebUI is a local tool by design, and running it on a network address with no authentication makes it an internet facing command runner.
Check firewall rules and cloud security groups for the port the WebUI uses. Review process lists for long running python processes started from the project folder.
What to do now
- Search for copies of the project on workstations, servers and in container registries.
- Stop the WebUI wherever it is exposed beyond localhost, and bind it to 127.0.0.1 or put authentication in front of it.
- Check the repository for a newer commit that addresses the advisory, and move to it if one exists.
- Run it in a container or virtual machine with no credentials, no cloud tokens and limited network access.
- Remove shared secrets and API keys from the environment of the account that runs it.
- Consider a maintained alternative if the project stays inactive.
Why it matters
The class is code injection, CWE-94 (Code Injection). A function reads text from a file whose location the user controls, and passes that text to eval, a Python feature that runs text as code. When the text is not trusted, eval is the same as giving the author of the text a way to run code on the host.
The record describes the file path as user input with the final path component changed to train.log. That limits which file is read, but it does not make the input safe, because the file contents are what matter. Any place a user can write a file to the right name, or any shared folder, becomes part of the attack surface.
The record does not say the flaw is exploited in the wild, and it is not on the CISA Known Exploited Vulnerabilities list. With no known patch, the response is to control who can reach the interface and what the account running it can touch.
Quick check
Is there a patched version?
The record says no known patches exist at publication. Check the project repository for newer commits and treat any copy as untrusted until you do.
Is eval itself the problem?
Yes, in this context. Passing file contents that a user can influence to eval runs them as code. A safe parser for the expected data format removes the risk.
Sources
Last reviewed: 18 October 2026.
