What is the CVSS score of CVE-2025-62373?

CVE-2025-62373 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Pipecat are affected by CVE-2025-62373?

Pipecat (versions 0.0.41-0.0.93) contains a remote code execution vulnerability in its optional LivekitFrameSerializer component that allows unauthenticated attackers to execute arbitrary code when…. A patch is available.

How to fix or mitigate CVE-2025-62373?

Within 24 hours, audit all Pipecat deployments to identify whether LivekitFrameSerializer is enabled; if active, immediately disable the serializer as interim mitigation and restrict WebSocket access to trusted internal clients only. Within 7 days, upgrade all affected instances to Pipecat version 0.0.94 or later, which removes the vulnerable serializer entirely. Within 30 days, complete upgrade verification across all environments, review WebSocket connection logs for suspicious activity during the exposure window, and implement persistent network segmentation to limit WebSocket connections to required sources.

Pipecat CVE-2025-62373

EUVD-2025-209570 CRITICAL

Deserialization of Untrusted Data (CWE-502)

2026-04-23 GitHub_M

GHSA-c2jg-5cp7-6wc7

RCE Python Deserialization Pipecat

9.8

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

When the non-default serializer is configured and network-exposed, unauthenticated attackers send pickle over WebSocket for trivial full-system RCE (PR:N, AC:L, C/I/A:H); config prerequisite limits real exposure but not base metrics.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Source Code Evidence Fetched

Jul 24, 2026 - 04:46 vuln.today

Analysis Generated

Jul 24, 2026 - 04:46 vuln.today

Patch released

Apr 29, 2026 - 15:00 nvd

Patch available

Apr 23, 2026 - 17:01 EUVD

EUVD ID Assigned

Apr 23, 2026 - 16:00 euvd

EUVD-2025-209570

CVE Published

Apr 23, 2026 - 14:40 nvd

CRITICAL 9.8

DescriptionGitHub Advisory

Pipecat is an open-source Python framework for building real-time voice and multimodal conversational agents. Versions 0.0.41 through 0.0.93 have a vulnerability in LivekitFrameSerializer - an optional, non-default, undocumented frame serializer class (now deprecated) intended for LiveKit integration. The class's deserialize() method uses Python's pickle.loads() on data received from WebSocket clients without any validation or sanitization. This means that a malicious WebSocket client can send a crafted pickle payload to execute arbitrary code on the Pipecat server. The vulnerable code resides in src/pipecat/serializers/livekit.py (around line 73), where untrusted WebSocket message data is passed directly into pickle.loads() for deserialization. If a Pipecat server is configured to use LivekitFrameSerializer and is listening on an external interface (e.g. 0.0.0.0), an attacker on the network (or the internet, if the service is exposed) could achieve remote code execution (RCE) on the server by sending a malicious pickle payload. Version 0.0.94 contains a fix. Users of Pipecat should avoid or replace unsafe deserialization and improve network security configuration. The best mitigation is to stop using the vulnerable LivekitFrameSerializer altogether. Those who require LiveKit functionality should upgrade to the latest Pipecat version and switch to the recommended LiveKitTransport or another secure method provided by the framework. Additionally, always follow secure coding practices: never trust client-supplied data, and avoid Python pickle (or similar unsafe deserialization) in network-facing components.

AnalysisAI

Remote code execution in the Pipecat voice/multimodal agent framework (Python) affects versions 0.0.41 through 0.0.93 when the optional, non-default LivekitFrameSerializer is enabled, because its deserialize() method feeds raw WebSocket bytes into pickle.loads() without validation. A malicious WebSocket client can send a crafted pickle payload to run arbitrary code on the server, and if the service listens on an external interface (e.g. 0.0.0.0) the attack is reachable over the network or internet. The issue is fixed in 0.0.94 (serializer removed); publicly available exploit code exists per the SSVC 'poc' status, but it is not listed in CISA KEV.

Technical ContextAI

Pipecat is an open-source Python framework for building real-time voice and multimodal conversational agents, using WebSocket transports to move audio frames between clients and the server. The affected component, LivekitFrameSerializer (src/pipecat/serializers/livekit.py, ~line 73), was an optional/undocumented adapter meant to translate between Pipecat audio frames and LiveKit's AudioFrame format; it was deprecated in 0.0.90 in favor of LiveKitTransport. The root cause is CWE-502 (Deserialization of Untrusted Data): Python's pickle.loads() reconstructs arbitrary objects and will invoke code paths (e.g. __reduce__) embedded in an attacker-crafted byte stream, so unpickling any network-controlled data is equivalent to arbitrary code execution. CPE cpe:2.3:a:pipecat-ai:pipecat:*:*:*:*:*:*:*:* identifies the affected package (pip: pipecat-ai).

RemediationAI

Vendor-released patch: 0.0.94 - upgrade pipecat-ai to 0.0.94 or later, in which LivekitFrameSerializer has been removed entirely (release: https://github.com/pipecat-ai/pipecat/releases/tag/v0.0.94). If you require LiveKit functionality, migrate to the recommended LiveKitTransport rather than the removed serializer. If you cannot upgrade immediately, the highest-value compensating control is to stop using LivekitFrameSerializer in your pipeline configuration (it is non-default, so most deployments simply do not reference it); as an interim network control, bind the WebSocket service to localhost instead of 0.0.0.0 and/or firewall the WebSocket port so only trusted clients can reach it, accepting that this breaks any legitimate remote clients. Do not attempt to 'sanitize' pickle input - there is no safe way to unpickle untrusted data; replace it with a safe serializer. Advisory reference: https://github.com/pipecat-ai/pipecat/security/advisories/GHSA-c2jg-5cp7-6wc7 .