Skip to content
OpenAdvisories

Package · PyPI

pipecat-ai

4 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

4 results · Feed

  • Medium 5.6
    CVE-2026-102682

    Pipecat: Public exposure of Pipecat’s development runner can allow unauthenticated bot session creation

    Pipecat is an open-source Python framework for building real-time voice and multimodal conversational agents. From 0.0.98 until 1.6.0, the pipecat-ai package's built-in development runner exposes unauthenticated endpoints including /start, /daily, and /daily-…

    pipecat-ai pipecat pipecat-ai PyPI
  • High 7.5
    CVE-2026-54695

    Pipecat: Telephony WebSocket `/ws` Unauthenticated Call-Control Abuse via Attacker-Supplied Call SID

    Pipecat is an open-source Python framework for building real-time voice and multimodal conversational agents. Prior to 1.4.0, the pipecat development runner registers a /ws WebSocket endpoint for telephony testing that accepts connections without authenticati…

    pipecat-ai pipecat pipecat-ai PyPI
  • High 7.5
    CVE-2026-44716

    Pipecat: Path Traversal in Pipecat Runner `/files` Endpoint — Arbitrary File Read via `%2F`-Encoded Separator

    Pipecat is an open-source Python framework for building real-time voice and multimodal conversational agents. From version 0.0.90 to before version 1.2.0, a path traversal vulnerability exists in Pipecat's development runner (src/pipecat/runner/run.py). When …

    pipecat-ai pipecat pipecat-ai PyPI
  • Critical 9.8
    CVE-2025-62373

    Pipecat vulnerable to Remote Code Execution by Pickle Deserialization via LivekitFrameSerializer

    Pipecat is an open-source Python framework for building real-time voice and multimodal conversational agents. Versions 0.0.41 through 0.0.93 have a vulnerability in `LivekitFrameSerializer` – an optional, non-default, undocumented frame serializer class (now …

    pipecat-ai pipecat pipecat-ai PyPI