Pipecat contains a code execution flaw due to an unsafe use of Python’s pickle deserialization in its optional LivekitFrameSerializer. The serializer accepts data from WebSocket clients and passes it directly to pickle.loads without any validation or sanitization. This leads to arbitrary code execution when a crafted pickle payload is sent, a classic instance of insecure deserialization (CWE‑502). The vulnerability exposes the hosting server to full compromise of confidentiality, integrity, and availability if exploited.

The issue affects the open‑source Python framework developed by pipecat‑ai, specifically the pipecat package. Versions ranging from 0.0.41 through 0.0.93 are vulnerable. The fix was rolled out in release 0.0.94, which removes the insecure deserialization path. Attackers can target any instance that is configured to use the deprecated LivekitFrameSerializer and is reachable on an external interface such as 0.0.0.0, whether exposed on the local network or the public internet.

The flaw carries a high severity with a CVSS score of 9.8. The EPSS score is below 1%, indicating that currently there are few known exploits, but the risk remains significant because the attack vector would be a network‑side WebSocket connection, which is trivial to establish against exposed services. The vulnerability is not listed in the CISA KEV catalog, but the combination of a high CVSS and the nature of the flaw warrants prompt remediation wherever the vulnerable serializer is active.