Retrieval-Based Voice Conversion WebUI Unsafe Deserialization Vulnerability Allowing Remote Code Execution

A vulnerability exists in Retrieval-Based Voice Conversion WebUI versions through 2.2.231006, allowing unsafe deserialization of user-provided model paths. This issue arises in the 'export.py' file, where the 'ckpt_dir' variable is used to load models with 'torch.load'. Such deserialization can lead to remote code execution.

Impact

Exploitation of this vulnerability can result in remote code execution on the server where the application is running.

Reproduction

To reproduce this vulnerability, provide a path to a malicious model file as input. The application will load the model using 'torch.load', which can be exploited to execute arbitrary code on the server.