CVE-2025-43852: RVC WebUI RCE Vulnerability via Unsafe

CVE-2025-43852 Overview

CVE-2025-43852 is a critical insecure deserialization vulnerability affecting Retrieval-based-Voice-Conversion-WebUI, a popular voice changing framework based on VITS (Variational Inference with adversarial learning for end-to-end Text-to-Speech). The vulnerability exists in versions 2.2.231006 and prior, where user-controlled input is passed directly to torch.load() without proper validation, enabling remote code execution through malicious pickle payloads.

The vulnerability stems from improper handling of user-supplied model paths in the voice conversion pipeline. When a user specifies a model path containing the string "DeEcho", the application instantiates an AudioPreDeEcho class that loads the model using PyTorch's torch.load() function. This function is known to be unsafe when loading untrusted data, as it can deserialize arbitrary Python objects, allowing attackers to execute malicious code on the target system.

Critical Impact

Remote attackers can achieve arbitrary code execution by supplying a malicious model file, potentially leading to complete system compromise, data exfiltration, or use of the system for further attacks.

Affected Products

• Retrieval-based-Voice-Conversion-WebUI versions 2.2.231006 and prior
• rvc-project retrieval-based-voice-conversion-webui (all versions without patch)

Discovery Timeline

• May 5, 2025 - CVE-2025-43852 published to NVD
• August 1, 2025 - Last updated in NVD database

Technical Details for CVE-2025-43852

Vulnerability Analysis

This insecure deserialization vulnerability (CWE-502) allows unauthenticated remote attackers to execute arbitrary code on systems running vulnerable versions of Retrieval-based-Voice-Conversion-WebUI. The attack requires no user interaction and can be exploited over the network, making it particularly dangerous for publicly accessible deployments.

The vulnerability chain begins in infer-web.py where the model_choose variable accepts user input specifying a path to a voice model. This input flows through the application without sanitization to the uvr function in vr.py. When the model name contains the substring "DeEcho", the code path leads to instantiation of the AudioPreDeEcho class, which uses the attacker-controlled path to load a model file via torch.load().

PyTorch's torch.load() function uses Python's pickle module for deserialization, which is inherently unsafe for untrusted data. Pickle can execute arbitrary Python code during deserialization through the __reduce__ method, allowing attackers to craft malicious model files that execute commands when loaded.

Root Cause

The root cause of this vulnerability is the use of torch.load() to deserialize user-supplied model files without validation or sandboxing. The torch.load() function relies on Python's pickle module, which can execute arbitrary code during object reconstruction. The application fails to implement proper input validation on the model path and does not use safer alternatives like torch.load() with weights_only=True or other serialization formats that don't support arbitrary code execution.

Attack Vector

The attack vector is network-based, requiring an attacker to either:

1. Supply a malicious model file path that points to an attacker-controlled file (if the application allows remote file loading)
2. Upload a malicious model file to a location accessible by the application and reference it through the model_choose parameter
3. Exploit path traversal or other file access mechanisms to reference a planted malicious model

The vulnerable code path is triggered when processing voice conversion requests that involve DeEcho functionality. An attacker crafts a malicious pickle payload disguised as a model file, which when loaded by torch.load(), executes arbitrary Python code with the privileges of the application process.

The vulnerability exists in the vr.py file at the torch.load() call within the AudioPreDeEcho class initialization, where user input flows from infer-web.py through the uvr function. For technical details, refer to the GitHub Security Advisory and the vulnerable code in vr.py.

Detection Methods for CVE-2025-43852

Indicators of Compromise

• Unexpected model files appearing in model directories, particularly with "DeEcho" in the filename
• Anomalous process spawning from Python processes running the WebUI application
• Unusual network connections originating from the application server
• Modified or newly created files in system directories following model loading operations
• Unexpected Python pickle deserialization errors in application logs

Detection Strategies

• Monitor for torch.load() calls with user-controllable paths in application traces
• Implement file integrity monitoring on model directories to detect unauthorized model uploads
• Use application-level logging to track model loading requests and flag paths containing unexpected characters or directory traversal sequences
• Deploy endpoint detection and response (EDR) solutions to identify post-exploitation behavior
• Analyze network traffic for unusual data exfiltration patterns from application servers

Monitoring Recommendations

• Enable verbose logging for all model loading operations in the application
• Implement real-time alerting on process creation events from the WebUI application context
• Monitor system calls for suspicious activity patterns associated with pickle deserialization attacks
• Set up honeypot model files to detect unauthorized access attempts
• Configure SIEM rules to correlate model loading events with subsequent anomalous system behavior

How to Mitigate CVE-2025-43852

Immediate Actions Required

• Restrict network access to Retrieval-based-Voice-Conversion-WebUI instances to trusted networks only
• Implement strict input validation on all model path parameters, rejecting paths containing directory traversal sequences or pointing to untrusted locations
• Run the application in a sandboxed environment with minimal privileges
• Disable or remove DeEcho functionality if not required
• Monitor the project repository for security patches and apply them immediately when available

Patch Information

As of the publication date, no official patch is available for this vulnerability. The vendor advisory at GitHub Security Lab provides additional details about the vulnerability scope. Organizations should monitor the official RVC-Project repository for security updates and consider implementing the workarounds below until a patch is released.

Workarounds

• Modify the application code to use torch.load() with weights_only=True parameter to prevent arbitrary code execution during deserialization
• Implement an allowlist of permitted model file paths and validate all user input against this list
• Deploy the application behind a Web Application Firewall (WAF) with rules to filter malicious requests
• Use containerization with read-only file systems for model directories to prevent malicious file placement
• Implement network segmentation to isolate the application from sensitive internal resources

# Example: Running application in restricted Docker container
docker run --read-only \
  --tmpfs /tmp \
  --security-opt no-new-privileges \
  --cap-drop ALL \
  --network none \
  rvc-webui:latest