CVE-2026-112078

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-112078
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-112078.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-112078
Published
2026-10-19T04:30:19Z
Modified
2026-10-21T02:55:50Z
Severity
  • 2.1 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P CVSS Calculator
Summary
RVC-Project Retrieval-based-Voice-Conversion-WebUI webui.py change_info_ code injection
Details

A flaw has been found in RVC-Project Retrieval-based-Voice-Conversion-WebUI up to 2.3.260718. Impacted is the function change_info_ of the file webui.py. Executing a manipulation of the argument ckpt_path can lead to code injection. The attack can be executed remotely. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.

Database specific 
{
    "cna_assigner":  "VulDB",
    "cwe_ids":  [
        "CWE-74",
        "CWE-94"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/112xxx/CVE-2026-112078.json"
}
References

Affected packages

Git / github.com/rvc-project/retrieval-based-voice-conversion-webui

Affected ranges

Type
GIT
Repo
https://github.com/rvc-project/retrieval-based-voice-conversion-webui
Events
Introduced
8f2fdbf483955f924b4c87ab34919170d0b704ed
Last Affected
8f2fdbf483955f924b4c87ab34919170d0b704ed
Database specific
Show details 
{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "2.3.260718"
                },
                {
                    "last_affected":  "2.3.260718"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandaloneSingleVersion"
        }
    ]
}

Affected versions

2.*
2.3.260718

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-112078.json"