Soumettre #1009621: RVC-Project Retrieval-based-Voice-Conversion-WebUI 2.3.260718 Code Injection

A vulnerability was found in Retrieval-based-Voice-Conversion-WebUI up to 2.3.260718 and classified as high 8.8. Affected is the change_info_ function of the webui.py component (webui.py:1719, wired by the ckpt_path2.change listener at webui.py:2820). The manipulation of the argument ckpt_path leads to code injection: the function reads the sidecar train.log file shipped inside a third-party model pack, takes the last tab-separated field of the first line, and passes it to Python eval(). It is possible to launch the attack remotely; user interaction is required in that the victim must select or paste the model path of a downloaded pack in the WebUI, which is the standard workflow for loading community voice-conversion models. The .pth weights of the pack remain entirely benign, so only the log text carries the attack.

Technical Details
- Affected file/function: webui.py / change_info_() (commit 81eed5e, lines 1715-1731; same code at tag 2.2.231006 infer-web.py:754-761)
- Vulnerable parameter: last tab-separated field of the first line of <model dir>/train.log
- Attack vector: Network (malicious model pack distributed via model-sharing sites or cloud drives)
- Privileges required: None
- Trigger condition: victim selects a model path in the WebUI checkpoint-extraction section, firing the ckpt_path2.change event; the payload rides in the message field of the project's own training-log format and is evaluated by eval(); the expression returns a well-formed model-info dict so the UI update succeeds with no visible anomaly

Impact
- Confidentiality: High (arbitrary code execution with WebUI process privileges, full file read access)
- Integrity: High (arbitrary file write/overwrite)
- Availability: High (arbitrary process/host disruption)

CVSS v3.1
Score: 8.8 (High)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Timeline
- Discovered: 2026-09-30
- Vendor notified: 2026-09-30 (public GitHub issue planned, see advisory link)
- Patch released: [pending]
- Public disclosure: [pending]

Countermeasure
Replace eval() with ast.literal_eval() or JSON parsing of the train.log info field, and treat parse failures as missing sidecar information (UI fallback) instead of executing or swallowing them. Until patched, do not load model packs from untrusted sources or strip train.log from downloaded packs before opening them in the WebUI.

• La source: ⚠️ https://github.com/RVC-Project/Retrieval-based-Voice-Conversion-WebUI/issues/2866
• Utilisateur: r1ck9 (UID 97869)
• Soumission: 01/10/2026 13:12 (il y a 18 jours)
• Modérer: 18/10/2026 16:02 (17 days later)
• Statut: Accepté
• Entrée VulDB: 421757 [RVC-Project Retrieval-based-Voice-Conversion-WebUI jusqu’à 2.3.260718 webui.py change_info_ ckpt_path élévation de privilèges]
• Points: 20