Live › vulnerability › CVE-2026-112078
Go to dashboardRetrieval-based-Voice-Conversion-WebUI up to 2.3.260718 fails to validate the ckpt_path argument in the change_info_ function of webui.py. A remote attacker can use a crafted value to inject code that runs on the host.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams running RVC-Project Retrieval-based-Voice-Conversion-WebUI up to 2.3.260718 where the web interface is reachable by others. The sources do not say whether the flaw needs a default or special configuration. Teams that do not run this project can skip it.
No product ranges from the sources yet.
2.3.260718Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A flaw has been found in RVC-Project Retrieval-based-Voice-Conversion-WebUI up to 2.3.260718. Impacted is the function change_info_ of the file webui.py. Executing a manipulation of the argument ckpt_path can lead to code injection. The attack can be executed remotely. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.
This page as .md · .json · in your agent: get_signal("CVE-2026-112078")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.