Skip to content
Threat Feed

Product

Pipecat-Ai

1 brief RSS
critical advisory

Pipecat Remote Code Execution via Pickle Deserialization in LivekitFrameSerializer

A critical vulnerability, CVE-2025-62373, exists in Pipecat's LivekitFrameSerializer where the deserialize() method uses Python's pickle.loads() on WebSocket data without validation, allowing a malicious WebSocket client to execute arbitrary code on the Pipecat server if LivekitFrameSerializer is explicitly enabled.

pipecat-ai remote code execution deserialization pipecat
2r 1t 1c 1i