CVE-2026-112078

RVC-Project Retrieval-based-Voice-Conversion-WebUI webui.py change_info_ code injection

State: Published
Severity: 5.3 Medium
Published: Oct 19, 2026
Updated: Oct 19, 2026
Reserved: Oct 18, 2026

Description

A flaw has been found in RVC-Project Retrieval-based-Voice-Conversion-WebUI up to 2.3.260718. Impacted is the function change_info_ of the file webui.py. Executing a manipulation of the argument ckpt_path can lead to code injection. The attack can be executed remotely. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.

Scores

CVSS	Score	Vector	Source
4.0	5.3 Medium	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P	VulDB
3.1	6.3 Medium	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C	VulDB
3.0	6.3 Medium	CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C	VulDB
2.0	7.5 High	AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:C	VulDB

Weaknesses

CWE-94 Code Injection
CWE-74 Injection

Affected Products

Product	Versions
Retrieval-based-Voice-Conversion-WebUIRVC-Project	2.3.260718Affected

References

VDB-421757 | RVC-Project Retrieval-based-Voice-Conversion-WebUI webui.py change_info_ code injectionvdb-entrytechnical-description
VDB-421757 | CTI Indicators (IOB, IOC, TTP, IOA)signaturepermissions-required
CVE-2026-112078 | CVE Analysis and Reportthird-party-advisory
Submit #1009621 | RVC-Project Retrieval-based-Voice-Conversion-WebUI 2.3.260718 Code Injectionthird-party-advisory
https://github.com/RVC-Project/Retrieval-based-Voice-Conversion-WebUI/issues/2866issue-tracking
https://github.com/user-attachments/files/32909432/rvc-train-log-eval-poc.zipexploit
https://github.com/RVC-Project/Retrieval-based-Voice-Conversion-WebUI/product

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.