GHSA-c2jg-5cp7-6wc7: Pipecat: Remote Code Execution by Pickle Deserialization Through LivekitFrameSerializer

Summary

A critical flaw in Pipecat's LivekitFrameSerializer, an optional, non-default, undocumented serializer deprecated in version 0.0.90, passes untrusted WebSocket message data directly to pickle.loads() in deserialize() in src/pipecat/serializers/livekit.py. A remote client that can reach a server using this serializer, for example one bound to 0.0.0.0, can send a crafted pickle payload to execute arbitrary code on the server with the Pipecat service's privileges.

Mitigation

The source does not state a fix yet. Check the original advisory for updates.

Affected packages in the Exposure Registry

Matched by package name and ecosystem. Each entry shows whether the package delegates to a language model and how many tracked packages depend on it.

• pipecat-aiPyPILLM dependency since 2024-05-13 · 1 tracked dependent

Topics

• Model and package supply chain

Related items

• HighCVE-2026-97677: IBM Langflow OSS arbitrary file write and read by authenticated flow authorsSimilar attack · NVD/CVE Database
• MediumRecent AI agent experiments reveal a risky future of machine 'teamwork' inside corporationsSimilar attack · CNBC Technology
• MediumClaude Code's “Don't Ask Again” File Exposes Passwords and Keys in 1,122 Public Copies on GitHubSimilar attack · The Hacker News
• MediumCVE-2026-118046: JS Help Desk plugin stored DOM-based cross-site scripting via jsticket_messageSimilar attack · NVD/CVE Database
• MediumARTEX abuse expands as cybercriminals target financial sectorSimilar attack · Microsoft Security Blog