Description
A flaw has been found in RVC-Project Retrieval-based-Voice-Conversion-WebUI up to 2.3.260718. Impacted is the function change_info_ of the file webui.py. Executing a manipulation of the argument ckpt_path can lead to code injection. The attack can be executed remotely. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.
Published: 2026-10-19
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Remote Code Execution
Action: Apply Patch
AI Analysis

Impact

A flaw in the change_info_ function of the RVC-Project Retrieval-based-Voice-Conversion-WebUI enables an attacker to inject code by manipulating the ckpt_path argument. Because the parameter is evaluated in a context that allows arbitrary code execution, a remote attacker can run malicious code on the host system. The vulnerability is rated with a CVSS score of 5.3 and has a publicly available exploit. The project has not yet released a fix, so the risk remains present.

Affected Systems

The affected product is RVC-Project Retrieval-based-Voice-Conversion-WebUI, all releases up to and including version 2.3.260718. No other affected versions are specified.

Risk and Exploitability

EPSS is not available, but the vulnerability is not listed in CISA KEV. Because the exploit is publicly available and can be triggered remotely, the potential impact is moderate to high. The attack requires sending a crafted request that contains a malicious ckpt_path value to the webUI endpoint; if successful it can lead to execution of arbitrary commands on the host where the webUI runs.

Generated by OpenCVE AI on October 19, 2026 at 05:20 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade to a version newer than 2.3.260718 that resolves the code injection
  • Apply network segmentation or firewall rules to limit remote access to the web UI
  • Implement strict validation and sanitization of the ckpt_path parameter to allow only safe file paths

Generated by OpenCVE AI on October 19, 2026 at 05:20 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 19 Oct 2026 04:45:00 +0000

Type Values Removed Values Added
Description A flaw has been found in RVC-Project Retrieval-based-Voice-Conversion-WebUI up to 2.3.260718. Impacted is the function change_info_ of the file webui.py. Executing a manipulation of the argument ckpt_path can lead to code injection. The attack can be executed remotely. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.
Title RVC-Project Retrieval-based-Voice-Conversion-WebUI webui.py change_info_ code injection
First Time appeared Rvc-project
Rvc-project retrieval-based-voice-conversion-webui
Weaknesses CWE-74
CWE-94
CPEs cpe:2.3:a:rvc-project:retrieval-based-voice-conversion-webui:*:*:*:*:*:*:*:*
Vendors & Products Rvc-project
Rvc-project retrieval-based-voice-conversion-webui
References
Metrics cvssV2_0

{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:C'}

cvssV3_0

{'score': 6.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C'}

cvssV3_1

{'score': 6.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Rvc-project Retrieval-based-voice-conversion-webui
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-10-19T04:30:19.922Z

Reserved: 2026-10-18T14:02:04.980Z

Link: CVE-2026-112078

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-19T05:17:04.570

Modified: 2026-10-19T05:17:04.570

Link: CVE-2026-112078

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-19T05:30:13Z

Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  • CWE-94

    Improper Control of Generation of Code ('Code Injection')