CVE-2026-112078

MEDIUM 6.3

RVC-Project Retrieval-based-Voice-Conversion-WebUI webui.py change_info_ code injection

CVSS Score

6.3

EPSS Score

0.0%

EPSS Percentile

0th

A flaw has been found in RVC-Project Retrieval-based-Voice-Conversion-WebUI up to 2.3.260718. Impacted is the function change_info_ of the file webui.py. Executing a manipulation of the argument ckpt_path can lead to code injection. The attack can be executed remotely. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.

CWE	CWE-94 CWE-74
Vendor	rvc-project
Product	retrieval-based-voice-conversion-webui
Published	Oct 19, 2026

Stay Ahead of the Next One

Get instant alerts for rvc-project retrieval-based-voice-conversion-webui

Be the first to know when new medium vulnerabilities affecting rvc-project retrieval-based-voice-conversion-webui are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Scope

Confidentiality

Integrity

Availability

Affected Versions

RVC-Project / Retrieval-based-Voice-Conversion-WebUI

2.3.260718

References

NVD ↗ CVE.org ↗ EPSS Data ↗

vuldb.com: https://vuldb.com/vuln/421757 vuldb.com: https://vuldb.com/vuln/421757/cti vuldb.com: https://vuldb.com/cve/CVE-2026-112078 vuldb.com: https://vuldb.com/submit/1009621 github.com: https://github.com/RVC-Project/Retrieval-based-Voice-Conversion-WebUI/issues/2866 github.com: https://github.com/user-attachments/files/32909432/rvc-train-log-eval-poc.zip github.com: https://github.com/RVC-Project/Retrieval-based-Voice-Conversion-WebUI/

Credits

🔍 r1ck9 (VulDB User) VulDB CNA Team