Pipecat
Monthly
Remote code execution in the Pipecat voice/multimodal agent framework (Python) affects versions 0.0.41 through 0.0.93 when the optional, non-default LivekitFrameSerializer is enabled, because its deserialize() method feeds raw WebSocket bytes into pickle.loads() without validation. A malicious WebSocket client can send a crafted pickle payload to run arbitrary code on the server, and if the service listens on an external interface (e.g. 0.0.0.0) the attack is reachable over the network or internet. The issue is fixed in 0.0.94 (serializer removed); publicly available exploit code exists per the SSVC 'poc' status, but it is not listed in CISA KEV.
Remote code execution in the Pipecat voice/multimodal agent framework (Python) affects versions 0.0.41 through 0.0.93 when the optional, non-default LivekitFrameSerializer is enabled, because its deserialize() method feeds raw WebSocket bytes into pickle.loads() without validation. A malicious WebSocket client can send a crafted pickle payload to run arbitrary code on the server, and if the service listens on an external interface (e.g. 0.0.0.0) the attack is reachable over the network or internet. The issue is fixed in 0.0.94 (serializer removed); publicly available exploit code exists per the SSVC 'poc' status, but it is not listed in CISA KEV.