RVC-Project vulnerabilities
We track 11 vulnerabilities in RVC-Project products. 11 are rated high or critical, and none are known to be exploited. The most recent was published on May 5, 2025.
Latest RVC-Project vulnerabilities
- 9.8 Critical severity
Retrieval-based-Voice-Conversion-WebUI: Deserialization of Untrusted Data
Retrieval-based-Voice-Conversion-WebUI is a voice changing framework based on VITS. Versions 2.2.231006 and prior are vulnerable to unsafe deserialization. The model_choose variable takes user input (e.g. a path to a model) and passes it to the uvr function in
- 9.8 Critical severity
Retrieval-based-Voice-Conversion-WebUI: Deserialization of Untrusted Data
Retrieval-based-Voice-Conversion-WebUI is a voice changing framework based on VITS. Versions 2.2.231006 and prior are vulnerable to unsafe deserialization. The model_choose variable takes user input (e.g. a path to a model) and passes it to the uvr function in
- 9.8 Critical severity
Retrieval-based-Voice-Conversion-WebUI: Deserialization of Untrusted Data
Retrieval-based-Voice-Conversion-WebUI is a voice changing framework based on VITS. Versions 2.2.231006 and prior are vulnerable to unsafe deserialization. The ckpt_dir variable takes user input (e.g. a path to a model) and passes it to the change_info functio
- 9.8 Critical severity
Retrieval-based-Voice-Conversion-WebUI: Deserialization of Untrusted Data
Retrieval-based-Voice-Conversion-WebUI is a voice changing framework based on VITS. Versions 2.2.231006 and prior are vulnerable to unsafe deserialization. The ckpt_a and cpkt_b variables take user input (e.g. a path to a model) and pass it to the merge functi
- 9.8 Critical severity
Retrieval-based-Voice-Conversion-WebUI: Deserialization of Untrusted Data
Retrieval-based-Voice-Conversion-WebUI is a voice changing framework based on VITS. Versions 2.2.231006 and prior are vulnerable to unsafe deserialization. The ckpt_path0 variable takes user input (e.g. a path to a model) and passes it to the change_info funct
- 9.8 Critical severity
Retrieval-based-Voice-Conversion-WebUI: Deserialization of Untrusted Data
Retrieval-based-Voice-Conversion-WebUI is a voice changing framework based on VITS. Versions 2.2.231006 and prior are vulnerable to unsafe deserialization. The ckpt_path2 variable takes user input (e.g. a path to a model) and passes it to the extract_small_mod
- 9.8 Critical severity
Retrieval-based-Voice-Conversion-WebUI: Deserialization of Untrusted Data
Retrieval-based-Voice-Conversion-WebUI is a voice changing framework based on VITS. Versions 2.2.231006 and prior are vulnerable to unsafe deserialization. The ckpt_path1 variable takes user input (e.g. a path to a model) and passes it to the show_info functio
- 9.8 Critical severity
Retrieval-based-Voice-Conversion-WebUI: Improper Control of Generation of Code
Retrieval-based-Voice-Conversion-WebUI is a voice changing framework based on VITS. Versions 2.2.231006 and prior are vulnerable to code injection. The ckpt_path2 variable takes user input (e.g. a path to a model) and passes it to change_info_ function, which
- 9.8 Critical severity
Retrieval-based-Voice-Conversion-WebUI: Improper Neutralization of Special Elements used in a Command
Retrieval-based-Voice-Conversion-WebUI is a voice changing framework based on VITS. Versions 2.2.231006 and prior are vulnerable to command injection. The variables exp_dir1, among others, take user input and pass it to the click_train function, which concaten
- 9.8 Critical severity
Retrieval-based-Voice-Conversion-WebUI: Improper Neutralization of Special Elements used in a Command
Retrieval-based-Voice-Conversion-WebUI is a voice changing framework based on VITS. Versions 2.2.231006 and prior are vulnerable to command injection. The variables exp_dir1, np7 and f0method8 take user input and pass it into the extract_f0_feature function, w
- 9.8 Critical severity
Retrieval-based-Voice-Conversion-WebUI: Improper Neutralization of Special Elements used in a Command
Retrieval-based-Voice-Conversion-WebUI is a voice changing framework based on VITS. Versions 2.2.231006 and prior are vulnerable to command injection. The variables exp_dir1, np7, trainset_dir4 and sr2 take user input and pass it to the preprocess_dataset func