CVE-2025-62373 - Vulnerability Analysis

Overview

Pipecat 0.0.41 through 0.0.93 contains a remote code execution caused by unsafe deserialization using pickle.loads() in LivekitFrameSerializer, letting remote attackers execute arbitrary code via crafted WebSocket payloads, exploit requires server configured with LivekitFrameSerializer and network exposure.

Severity & Score

Impact

Remote attackers can execute arbitrary code on the Pipecat server, potentially leading to full system compromise.

Mitigation

Upgrade to version 0.0.94 or later and avoid using LivekitFrameSerializer; use LiveKitTransport or other secure methods instead.

References

• https://github.com/pipecat-ai/pipecat/security/advisories/GHSA-c2jg-5cp7-6wc7

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner