CVE-2025-43847 is a critical (CVSS 9.8) unsafe deserialization flaw in Retrieval-based-Voice-Conversion-WebUI 2.2.231006 and earlier. The extract_small_model function loads a user chosen model file with torch.load, which can lead to remote code execution. The record says no known patch exists, so only load model files you trust.
What's affected
The record lists Retrieval-based-Voice-Conversion-WebUI, a voice changing framework based on VITS, in versions 2.2.231006 and prior. The affected function is extract_small_model in process_ckpt.py, and the variable ckpt_path2 takes user input.
The record says that as of publication no known patches exist. GitHub Security Lab, which found the issues, says it asked the project for a vulnerability contact in January 2025 and was told that the repository was not fully active. It assigned CVEs after its 90 day disclosure period. Check the project's repository for any later commit before you assume it is still unfixed.
The record explains the path. The ckpt_path2 variable takes user input, such as a path to a model, and passes it to the extract_small_model function in process_ckpt.py. That function loads the file with torch.load, which can lead to unsafe deserialization.
How to check if you're exposed
Find out whether you or your team run this project. Search developer machines, notebooks and GPU servers for a checkout of the repository or a container image built from it. Look for the file infer-web.py, which is the web interface entry point named in the record.
If you find a copy, check its commit and version against 2.2.231006 with git log -1 from the checkout directory. Then check what model files it has loaded and where they came from. Models downloaded from public hubs, forums and chat groups are the usual source of untrusted files.
Check firewall rules and cloud security groups for the port the WebUI uses. Review process lists for long running python processes started from the project folder.
What to do now
- Search for copies of the project on workstations, servers and in container registries.
- Stop the WebUI wherever it is exposed beyond localhost, and bind it to 127.0.0.1 or put authentication in front of it.
- Only open model files from sources you trust and can verify, and prefer weight formats that do not rely on pickle.
- Check the repository for a newer commit that addresses the advisory, and move to it if one exists.
- Run it in a container or virtual machine with no credentials, no cloud tokens and limited network access.
- Remove shared secrets and API keys from the environment of the account that runs it.
- Consider a maintained alternative if the project stays inactive.
Why it matters
The class is deserialization of untrusted data, CWE-502 (Deserialization of Untrusted Data). The function extract_small_model loads a model file with torch.load, and PyTorch's default loading format is built on Python pickle. Pickle can run code as part of loading, so a model file from an untrusted source can carry code that runs when it is opened.
This is a well known class of risk for model sharing. Model files feel like data, so people download and open them casually. In this project the path comes from the web interface, so anyone who can reach the interface can point the server at a file. The vector shows network access, low complexity, no privileges and no user interaction.
PyTorch documents options that restrict what torch.load will accept, and there are safer file formats for weights. Check the current PyTorch documentation for the options available in your version. The record does not say the flaw is exploited in the wild, and it is not on the CISA Known Exploited Vulnerabilities list.
Quick check
Is there a patched version?
The record says no known patches exist at publication. Check the project repository for newer commits and treat any copy as untrusted until you do.
Can I make loading models safe?
You can reduce the risk by loading only trusted files and by using safer formats and loader options described in the PyTorch documentation. The project itself has no known patch, so keep the interface private as well.
Sources
Last reviewed: 18 October 2026.
