RVC WebUI EUVD-2026-104066

Exploitation requires the attacker to be able to reach the Gradio-based WebUI and control the ckpt_path argument passed to the change_info_ model-info function in webui.py. The WebUI binds to localhost (127.0.0.1) by default, so the 'remote' vector is only realistic when the operator has explicitly exposed the interface (e.g., Gradio --listen/share or a reverse proxy/tunnel) to an untrusted network. No authentication is enforced by the default interface (PR:N), but user/operator interaction is required to submit the crafted checkpoint path (UI:P). Principal limiting factors: default local-only binding, required UI interaction, absence of auth meaning risk is concentrated on exposed instances, and the niche, non-enterprise deployment base.

This is a medium-severity (CVSS 4.0 base 5.3) code injection flaw (CWE-94) in the RVC-Project Retrieval-based-Voice-Conversion-WebUI, with publicly available exploit code but no CISA KEV listing and no EPSS score provided. The signals are mixed: the CVSS 4.0 vector claims a network attack vector with no privileges (AV:N/PR:N) which, combined with a published PoC (E:P), looks alarming, yet the vendor rated the three impact metrics as only Low (VC:L/VI:L/VA:L) despite this being a code-injection/RCE class bug - code injection normally yields full technical impact, so the Low ratings appear conservative or under-scored. More importantly, the 'attack can be executed remotely' claim should be treated with skepticism: this is a self-hosted Gradio-based ML tool that by default binds to localhost, so genuine remote exploitation depends on the operator having deliberately exposed the interface to the network. The vulnerability was reported solely by VulDB, the project was notified via a GitHub issue but has NOT responded, and there is no independent vendor confirmation. Net assessment: a real, exploitable code-execution bug worth patching for anyone who exposes the WebUI, but NOT a widespread-exploitation priority - the combination of a niche hobbyist product, default local-only binding, required user interaction (UI:P), and no KEV/EPSS evidence points to limited, opportunistic risk rather than a mass-exploited emergency.

An attacker who can reach an exposed RVC WebUI instance (or who tricks an operator into loading a malicious artifact) supplies a crafted ckpt_path value to the change_info_ function in webui.py, which is unsafely evaluated and results in code injection on the host. A public proof-of-concept (packaged as rvc-train-log-eval-poc.zip) has been published, lowering the bar for exploitation. Because the Gradio UI binds to localhost by default, practical remote exploitation requires the instance to have been intentionally exposed to the network.