Critical RCE in Pipecat Python Framework: CVE-2025-62373

The National Vulnerability Database (NVD) has detailed CVE-2025-62373, a critical remote code execution (RCE) vulnerability in Pipecat, an open-source Python framework for real-time conversational agents. Affecting versions 0.0.41 through 0.0.93, the flaw resides within the LivekitFrameSerializer class. This optional, non-default component, now deprecated, improperly uses Python’s pickle.loads() function on unvalidated data received from WebSocket clients.

A malicious WebSocket client can exploit this by sending a crafted pickle payload, leading to arbitrary code execution on the Pipecat server. This is a classic deserialization vulnerability (CWE-502). The NVD highlights that if a Pipecat server is configured with this specific serializer and exposed externally, an attacker can achieve RCE with a CVSS score of 9.8 (Critical). The vulnerable code, located in src/pipecat/serializers/livekit.py, directly passes untrusted WebSocket message data to pickle.loads().

Pipecat has addressed this in version 0.0.94. Defenders must prioritize upgrading to the latest version and migrating away from the LivekitFrameSerializer to safer alternatives like LiveKitTransport. The NVD emphasizes that secure coding practices, especially avoiding unsafe deserialization like Python pickle in network-facing components, are paramount.