{"action":"Upgrade pipecat-ai to 0.0.94 or later.","affected":[{"fixed":"0.0.94","introduced":"0.0.41"}],"component":"pipecat-ai","cve_ids":["CVE-2025-62373"],"ecosystem":"PyPI","epss":0.00701,"exploited":false,"fixed_versions":["0.0.94"],"ghsa_id":"GHSA-c2jg-5cp7-6wc7","id":"tcs_01M5KFBYF7EV2CA32X4T80GE7D","modified_at":"2026-06-29T12:26:06.476582704Z","published_at":"2026-04-23T21:15:42Z","references":["https://osv.dev/vulnerability/GHSA-c2jg-5cp7-6wc7","https://github.com/pipecat-ai/pipecat/security/advisories/GHSA-c2jg-5cp7-6wc7","https://nvd.nist.gov/vuln/detail/CVE-2025-62373","https://github.com/pipecat-ai/pipecat","https://github.com/pipecat-ai/pipecat/releases/tag/v0.0.94"],"severity":{"label":"critical","score":9.8},"sources":[{"source":"osv","source_id":"GHSA-c2jg-5cp7-6wc7","url":"https://osv.dev/vulnerability/GHSA-c2jg-5cp7-6wc7"}],"summary":"Pipecat: Remote Code Execution by Pickle Deserialization Through LivekitFrameSerializer"}