{"action":"Upgrade pipecat-ai to 0.0.94 or later.","affected":[{"fixed":"0.0.94","introduced":"0.0.41"}],"component":"pipecat-ai","cve_ids":["CVE-2025-62373"],"ecosystem":"PyPI","epss":0.00701,"exploited":false,"fixed_versions":["0.0.94"],"ghsa_id":"GHSA-c2jg-5cp7-6wc7","id":"tcs_01M5KHBFS40QN09ENGJ50JTSM7","modified_at":"2026-07-01T20:23:00.353248Z","published_at":"2026-06-29T11:50:46.103956Z","references":["https://osv.dev/vulnerability/PYSEC-2026-458","https://github.com/pipecat-ai/pipecat/security/advisories/GHSA-c2jg-5cp7-6wc7","https://nvd.nist.gov/vuln/detail/CVE-2025-62373","https://github.com/pipecat-ai/pipecat","https://github.com/pipecat-ai/pipecat/releases/tag/v0.0.94","https://pypi.org/project/pipecat-ai","https://github.com/advisories/GHSA-c2jg-5cp7-6wc7"],"severity":{"label":"critical","score":9.8},"sources":[{"source":"osv","source_id":"PYSEC-2026-458","url":"https://osv.dev/vulnerability/PYSEC-2026-458"}],"summary":"Pipecat: Remote Code Execution by Pickle Deserialization Through LivekitFrameSerializer"}