CVE-2025-43851: Critical Unsafe Deserialization in RVC UVR

CVE-2025-43851 is a critical unsafe deserialization flaw in Retrieval-based-Voice-Conversion-WebUI, an open source voice conversion tool. Versions 2.2.231006 and earlier are affected, and the record says no patch exists. Do not expose the WebUI to untrusted users, and load model files only from sources you trust.

What's affected

• Product: Retrieval-based-Voice-Conversion-WebUI from the RVC Project.
• Affected: version 2.2.231006 and earlier.
• Fixed version: none was known when the CVE was published. The record states that no known patches exist, so check the project repository for newer commits before relying on this.
• Entry point: the model_choose input reaches uvr in vr.py, where a model name or path passed to the vocal separation feature, which builds an AudioPre object is loaded with torch.load.
• Severity: CVSS 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), rated Critical.

How to check if you're exposed

This tool is usually cloned from GitHub rather than installed from a package index, so a normal dependency scan may not list it. Start with the checkout itself.

# which commit are you running?
git -C /path/to/Retrieval-based-Voice-Conversion-WebUI rev-parse HEAD

# find every place a model file is loaded
grep -rn "torch.load" /path/to/Retrieval-based-Voice-Conversion-WebUI | grep "[.]py"

Then answer three questions. Is the WebUI reachable from anything other than your own machine? Does it sit behind authentication of any kind? Who can type a model path into it? If the answer to the first is yes and the second is no, treat the host as exposed.

To see which of your projects pull in an affected component, run the free in-browser dependency scan at gold.safeguard.sh/scan. Reachability analysis then helps you separate libraries that your code actually calls from ones that only sit in a lockfile.

What to do now

1. Stop exposing the WebUI to the internet or to shared networks. Bind it to localhost, or put it behind a reverse proxy that requires a login.
2. Run it in a container or a throwaway VM with no access to credentials, cloud keys or your source code.
3. Load model files only from sources you trust and have checked. A model file is code to the loader, not just data.
4. Check the project repository and the GitHub Security Lab advisory for a fix before you update. Do not assume a newer tag is safe without reading the change.
5. If you maintain a fork, review every torch.load call and use the weights_only option that PyTorch provides where the file format allows it.

Why it matters

The weakness is CWE-502, deserialization of untrusted data. PyTorch checkpoints are Python pickles by default, and loading a pickle can run code chosen by whoever made the file. Here, a model name or path passed to the vocal separation feature, which builds an AudioPre object flows into torch.load without a check on where the file came from, so a path the attacker controls becomes code that runs on the server. The vector is network, low complexity, no privileges and no user interaction, which is why the score is 9.8.

This is one of several related findings in the same project. The GitHub Security Lab advisory covers a group of issues that share the same pattern, and this CVE describes one entry point of them. Fixing one call site does not fix the others, which matters if you maintain a fork. The advisory also notes that the project's contributors said the repository was not fully active, so do not wait on a vendor patch. The record does not mark this CVE as exploited in the wild, and CISA has not listed it as a Known Exploited Vulnerability.

Try it yourself

Click through it at your own pace, or open it full screen.

Quick check

Sources

• GitHub Security Lab advisory GHSL-2025-012 to GHSL-2025-022
• NVD record

Last reviewed: 18 October 2026.