CVE-2025-43845 is a critical code injection vulnerability affecting the Retrieval-based-Voice-Conversion-WebUI (RVC-Project), a voice changing framework based on VITS technology. The vulnerability exists in versions 2.2.231006 and earlier. Specifically, the issue arises from the handling of the 'ckpt_path2' variable, which accepts user input representing a file path to a model. This input is passed to the 'change_info_' function, which modifies the path to point to a 'train.log' file and reads its contents. The critical flaw is that the contents of this file are then passed directly to the Python 'eval' function without proper sanitization or validation. Since 'eval' executes the input as code, an attacker can craft malicious content within the targeted file to achieve remote code execution (RCE) on the server running the vulnerable application. This vulnerability requires no authentication or user interaction, making it remotely exploitable over the network. The CVSS 4.0 base score is 8.9 (high severity), reflecting the ease of exploitation (network vector, no privileges or user interaction required) and the high impact on confidentiality, integrity, and availability. No patches or mitigations are currently available, increasing the risk for organizations using affected versions. The vulnerability falls under CWE-94 (Improper Control of Generation of Code), a well-known category of critical security flaws that can lead to full system compromise if exploited. Given the nature of the software—a voice conversion web interface—this vulnerability could be leveraged to execute arbitrary commands, deploy malware, or pivot within an affected network.

For European organizations, the impact of CVE-2025-43845 can be severe. Organizations using the Retrieval-based-Voice-Conversion-WebUI in research, media production, or voice technology services could face full system compromise. The RCE capability allows attackers to steal sensitive data, disrupt services, or use the compromised system as a foothold for lateral movement within corporate networks. This could lead to data breaches involving personal or proprietary information, intellectual property theft, and operational downtime. Additionally, the voice conversion technology might be integrated into customer-facing applications, increasing the risk of reputational damage if exploited. The lack of available patches means organizations must rely on immediate mitigations or workarounds, increasing operational complexity and risk. Given the high severity and ease of exploitation, attackers could automate attacks, potentially targeting multiple European entities simultaneously. The impact extends beyond confidentiality to integrity and availability, as attackers could modify or delete data and disrupt voice conversion services critical to business operations.

Since no official patches are available, European organizations should implement the following specific mitigations: 1) Immediately restrict network access to the Retrieval-based-Voice-Conversion-WebUI service, limiting it to trusted internal users only via firewall rules or VPNs. 2) Employ application-layer filtering or web application firewalls (WAFs) to detect and block suspicious input patterns targeting the 'ckpt_path2' parameter, especially attempts to manipulate file paths or inject code. 3) Conduct thorough code reviews and, if feasible, modify the source code to replace the use of 'eval' with safer alternatives such as 'ast.literal_eval' or implement strict input validation and sanitization to prevent execution of arbitrary code. 4) Monitor logs for unusual file access or execution patterns related to 'train.log' or other files in the application directory. 5) Isolate the application environment using containerization or sandboxing to limit the blast radius in case of exploitation. 6) Prepare incident response plans specific to RCE scenarios and conduct employee awareness training on this vulnerability. 7) Engage with the vendor or open-source community to track patch releases and apply updates promptly once available.