CVE-2026-112078

A flaw has been found in RVC-Project Retrieval-based-Voice-Conversion-WebUI up to 2.3.260718. Impacted is the function changeinfo of the file webui.py. Executing a manipulation of the argument ckptpath can lead to code injection. The attack can be executed remotely. The exploit has been published...

CVE-2026-112078 RVC-Project Retrieval-based-Voice-Conversion-WebUI webui.py change_info_ code injection

A flaw has been found in RVC-Project Retrieval-based-Voice-Conversion-WebUI up to 2.3.260718. Impacted is the function changeinfo of the file webui.py. Executing a manipulation of the argument ckptpath can lead to code injection. The attack can be executed remotely. The exploit has been published...

CVE-2026-112078

A flaw has been found in RVC-Project Retrieval-based-Voice-Conversion-WebUI up to 2.3.260718. Impacted is the function changeinfo of the file webui.py. Executing a manipulation of the argument ckptpath can lead to code injection. The attack can be executed remotely. The exploit has been published...

EUVD-2026-104066

A flaw has been found in RVC-Project Retrieval-based-Voice-Conversion-WebUI up to 2.3.260718. Impacted is the function changeinfo of the file webui.py. Executing a manipulation of the argument ckptpath can lead to code injection. The attack can be executed remotely. The exploit has been published...

CVE-2026-112078

A code injection vulnerability exists in RVC-Project Retrieval-based-Voice-Conversion-WebUI versions up to 2.3.260718 . The flaw is located in the change_info_ function within the webui.py file. An attacker can achieve remote code execution by manipulating the ckpt_path argument. While the projec...

CVE-2026-112078 RVC-Project Retrieval-based-Voice-Conversion-WebUI webui.py change_info_ code injection

A flaw has been found in RVC-Project Retrieval-based-Voice-Conversion-WebUI up to 2.3.260718. Impacted is the function changeinfo of the file webui.py. Executing a manipulation of the argument ckptpath can lead to code injection. The attack can be executed remotely. The exploit has been published...

PT-2026-117222

A flaw has been found in RVC-Project Retrieval-based-Voice-Conversion-WebUI up to 2.3.260718. Impacted is the function change info of the file webui.py. Executing a manipulation of the argument ckpt path can lead to code injection. The attack can be executed remotely. The exploit has been publish...

ethos-cli (0.1.0), flowsets (0.0.9) +4 more potentially affected by CVE-2026-55404 via yt-dlp (2025.1.26)

yt-dlp PYPI version 2025.1.26 is affected by a known vulnerability. The following packages have a transitive dependency on yt-dlp and may be impacted: - ethos-cli 0.1.0 - flowsets 0.0.9 - rvc-cli =1.1.0, =0.11.8, =2025.1.28, =2025.2.17 Source cves: CVE-2026-55404 Source advisory: OSV:PYSEC-2026-3...

ethos-cli (0.1.0), flowsets (0.0.9) +4 more potentially affected by CVE-2026-55404 via yt-dlp (2025.1.26)

yt-dlp PYPI version 2025.1.26 is affected by a known vulnerability. The following packages have a transitive dependency on yt-dlp and may be impacted: - ethos-cli 0.1.0 - flowsets 0.0.9 - rvc-cli =1.1.0, =0.11.8, =2025.1.28, =2025.2.17 Source cves: CVE-2026-55404 Source advisory:...

ethos-cli (0.1.0), flowsets (0.0.9) +4 more potentially affected by CVE-2026-50023 via yt-dlp (2025.1.26)

yt-dlp PYPI version 2025.1.26 is affected by a known vulnerability. The following packages have a transitive dependency on yt-dlp and may be impacted: - ethos-cli 0.1.0 - flowsets 0.0.9 - rvc-cli =1.1.0, =0.11.8, =2025.1.28, =2025.2.17 Source cves: CVE-2026-50023 Source advisory: OSV:PYSEC-2026-3...

ethos-cli (0.1.0), flowsets (0.0.9) +4 more potentially affected by CVE-2026-50574 via yt-dlp (2025.1.26)

yt-dlp PYPI version 2025.1.26 is affected by a known vulnerability. The following packages have a transitive dependency on yt-dlp and may be impacted: - ethos-cli 0.1.0 - flowsets 0.0.9 - rvc-cli =1.1.0, =0.11.8, =2025.1.28, =2025.2.17 Source cves: CVE-2026-50574 Source advisory: OSV:PYSEC-2026-3...

cleanunet-denoiser (>=0.0.1.dev1, <=0.0.1.dev3), depthflow (>=0.7.0.dev1, <=0.8.0) +4 more potentially affected by CVE-2024-8966 via gradio (4.44.0)

gradio PYPI version 4.44.0 is affected by a known vulnerability. The following packages have a transitive dependency on gradio and may be impacted: - cleanunet-denoiser =0.0.1.dev1, =0.7.0.dev1, =0.4.5, =0.5.9, =1.0.2, =1.0.8 Source cves: CVE-2024-8966 Source advisory: OSV:PYSEC-2026-1410...

ethos-cli (0.1.0), flowsets (0.0.9) +4 more potentially affected by CVE-2026-50574 via yt-dlp (2025.1.26)

yt-dlp PYPI version 2025.1.26 is affected by a known vulnerability. The following packages have a transitive dependency on yt-dlp and may be impacted: - ethos-cli 0.1.0 - flowsets 0.0.9 - rvc-cli =1.1.0, =0.11.8, =2025.1.28, =2025.2.17 Source cves: CVE-2026-50574 Source advisory:...

ethos-cli (0.1.0), flowsets (0.0.9) +4 more potentially affected by CVE-2026-50023 via yt-dlp (2025.1.26)

yt-dlp PYPI version 2025.1.26 is affected by a known vulnerability. The following packages have a transitive dependency on yt-dlp and may be impacted: - ethos-cli 0.1.0 - flowsets 0.0.9 - rvc-cli =1.1.0, =0.11.8, =2025.1.28, =2025.2.17 Source cves: CVE-2026-50023 Source advisory:...

cleanunet-denoiser (>=0.0.1.dev1, <=0.0.1.dev3), depthflow (>=0.7.0.dev1, <=0.8.0) +4 more potentially affected by CVE-2026-10783 via gradio (4.44.0)

gradio PYPI version 4.44.0 is affected by a known vulnerability. The following packages have a transitive dependency on gradio and may be impacted: - cleanunet-denoiser =0.0.1.dev1, =0.7.0.dev1, =0.4.5, =0.5.9, =1.0.2, =1.0.8 Source cves: CVE-2026-10783 Source advisory: OSV:PYSEC-2026-211...

cleanunet-denoiser (>=0.0.1.dev1, <=0.0.1.dev3), depthflow (>=0.7.0.dev1, <=0.8.0) +4 more potentially affected by CVE-2026-28416 via gradio (4.44.0)

gradio PYPI version 4.44.0 is affected by a known vulnerability. The following packages have a transitive dependency on gradio and may be impacted: - cleanunet-denoiser =0.0.1.dev1, =0.7.0.dev1, =0.4.5, =0.5.9, =1.0.2, =1.0.8 Source cves: CVE-2026-28416 Source advisory: OSV:PYSEC-2026-66...

Retrieval-based-Voice-Conversion-WebUI command injection vulnerability

Retrieval-based-Voice-Conversion-WebUI is an open source voice training modeling tool from RVC-Project. A command injection vulnerability exists in Retrieval-based-Voice-Conversion-WebUI version 2.2.231006 and earlier, which stems from command injection...

cleanunet-denoiser (>=0.0.1.dev1, <=0.0.1.dev3), depthflow (>=0.7.0.dev1, <=0.8.0) +4 more potentially affected by CVE-2025-23042 via gradio (4.44.0)

gradio PYPI version 4.44.0 is affected by a known vulnerability. The following packages have a transitive dependency on gradio and may be impacted: - cleanunet-denoiser =0.0.1.dev1, =0.7.0.dev1, =0.4.5, =0.5.9, =1.0.2, =1.0.8 Source cves: CVE-2025-23042 Source advisory: OSV:PYSEC-2025-118...

cleanunet-denoiser (>=0.0.1.dev1, <=0.0.1.dev3), depthflow (>=0.7.0.dev1, <=0.8.0) +4 more potentially affected by CVE-2025-23042 via gradio (4.44.0)

gradio PYPI version 4.44.0 is affected by a known vulnerability. The following packages have a transitive dependency on gradio and may be impacted: - cleanunet-denoiser =0.0.1.dev1, =0.7.0.dev1, =0.4.5, =0.5.9, =1.0.2, =1.0.8 Source cves: CVE-2025-23042 Source advisory: OSV:GHSA-J2JG-FQ62-7C3H...

cleanunet-denoiser (>=0.0.1.dev1, <=0.0.1.dev3), depthflow (>=0.7.0.dev1, <=0.8.0) +4 more potentially affected by CVE-2024-47871 via gradio (4.44.0)

gradio PYPI version 4.44.0 is affected by a known vulnerability. The following packages have a transitive dependency on gradio and may be impacted: - cleanunet-denoiser =0.0.1.dev1, =0.7.0.dev1, =0.4.5, =0.5.9, =1.0.2, =1.0.8 Source cves: CVE-2024-47871 Source advisory: OSV:PYSEC-2024-219...