{"uuid": "bd9878f2-8964-403c-b4c6-0f9257a740d5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2025-43852", "type": "seen", "source": "https://t.me/cvedetector/24483", "content": "{\n  \"Source\": \"CVE FEED\",\n  \"Title\": \"CVE-2025-43852 - Apache Retrieval-based-Voice-Conversion-WebUI Deserialization Remote Code Execution Vulnerability\", \n  \"Content\": \"CVE ID : CVE-2025-43852 \nPublished : May 5, 2025, 7:15 p.m. | 20\u00a0minutes ago \nDescription : Retrieval-based-Voice-Conversion-WebUI is a voice changing framework based on VITS. Versions 2.2.231006 and prior are vulnerable to unsafe deserialization. The\u00a0model_choose\u00a0variable\u00a0takes user input\u00a0(e.g. a path to a model) and\u00a0passes\u00a0it to the\u00a0uvr\u00a0function in\u00a0vr.py. In\u00a0uvr\u00a0, if\u00a0model_name\u00a0contains the string\u00a0\"DeEcho\", a new instance of\u00a0AudioPreDeEcho\u00a0class is created with the\u00a0model_path\u00a0attribute containing the aforementioned user input. In the\u00a0AudioPreDeEcho\u00a0class, the user input is used to\u00a0load the model on that path with\u00a0torch.load, which can lead to unsafe deserialization and remote code execution. As of time of publication, no known patches exist. \nSeverity: 0.0 | NA \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n  \"Detection Date\": \"05 May 2025\",\n  \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "creation_timestamp": "2025-05-05T21:44:20.000000Z"}