CVE-2025-43850 | RVC-Project Retrieval-based-Voice-Conversion-WebUI up to 2.2.231006 export.py change_info ckpt_dir deserialization (GHSL-2025-012)

A vulnerability classified as very critical was found in RVC-Project Retrieval-based-Voice-Conversion-WebUI up to 2.2.231006. Affected by this vulnerability is the function change_info of the file export.py. The manipulation of the argument ckpt_dir leads to deserialization.

This vulnerability is known as CVE-2025-43850. The attack can be launched remotely. There is no exploit available.