CVE-2025-62373 Security Alert: CRITICAL Vulnerability

Urgent: CVE-2025-62373 requires immediate attention.

· 3 min read

```html

Executive Summary

A critical vulnerability (CVE-2025-62373) has been identified in Pipecat's LivekitFrameSerializer, allowing remote code execution (RCE) through unsafe deserialization. This flaw affects developers using this deprecated serializer in their applications, posing a significant risk if exposed to untrusted networks. Immediate action is required to mitigate potential exploitation.

Immediate Action

  • Stop using LivekitFrameSerializer in your applications immediately.
  • Upgrade to the latest version of Pipecat that does not include the vulnerable serializer.
  • Bind your Pipecat WebSocket server to localhost (127.0.0.1) to limit network exposure.
  • Implement authentication on WebSocket connections to prevent unauthorized access.
  • Review and sanitize any incoming data handling in your application.
  • For more details, refer to the vendor's advisory (link to be added).

Affected Versions

  • pipecat@<=0.0.90 vulnerable; upgrade to 0.0.91+

Resolution Guide

To resolve the vulnerability, upgrade your Pipecat installation:

pip install --upgrade pipecat

For configuration hardening, ensure your Pipecat server is bound to localhost:

async with websockets.serve(handler, "127.0.0.1", 8765):

If you must use a serializer, switch to the safer LiveKitTransport method. Here’s an example:

from pipecat.transport import LiveKitTransport

Detection & Verification

To check if your application is vulnerable, verify the installed version of Pipecat:

pip show pipecat

To ensure the fix is applied, confirm the version is updated:

pip show pipecat

Additionally, search for the presence of LivekitFrameSerializer in your codebase:

grep -r "LivekitFrameSerializer" .

Risk and Impact

If exploited, this vulnerability allows an attacker to execute arbitrary code on the server, potentially leading to full system compromise. The risk is particularly high for any Pipecat instance exposed to the internet, where an attacker could gain control over the server environment, execute commands, and access sensitive data.

```

Keep reading