- Latest release
- 1.15.0 (Oct 29, 2026): no advisory affects it
- Newest unaffected release
- 1.15.0 (Oct 29, 2026), the latest release
- Advisories
- 4 · 1 critical, 2 high, 1 medium
- Weekly downloads
- 348.5K
- Dependents
- 121
- Releases
- 118 since 0.0.9 (May 13, 2024)
- Registry
- PyPI
- Releases read
- Nov 8, 2026
Version timeline
- CVE-2026-102682Affects 0.0.98 to 1.5.0 (1.6.0 is outside it)
- CVE-2026-54695Affects 0.0.77 to 1.3.0 (1.4.0 is outside it)
- CVE-2026-44716Affects 0.0.90 to 1.1.0 (1.2.0 is outside it)
- CVE-2025-62373Affects 0.0.41 to 0.0.93 (0.0.94 is outside it)
Advisories 4
- CVE-2026-102682Medium 5.6
Pipecat: Public exposure of Pipecat’s development runner can allow unauthenticated bot session creation
Affected: from 0.0.98, fixed in 1.6.0.
Fixed in 1.6.0 (released Jul 21, 2026, 85 days before disclosure).
The latest release, 1.15.0, is not affected.
- CVE-2026-54695High 7.5
Pipecat: Telephony WebSocket `/ws` Unauthenticated Call-Control Abuse via Attacker-Supplied Call SID
Affected: from 0.0.77, fixed in 1.4.0.
Fixed in 1.4.0 (released Jun 17, 2026, 22 days before disclosure).
The latest release, 1.15.0, is not affected.
- CVE-2026-44716High 7.5
Pipecat: Path Traversal in Pipecat Runner `/files` Endpoint — Arbitrary File Read via `%2F`-Encoded Separator
Affected: from 0.0.90, fixed in 1.2.0.
Fixed in 1.2.0 (released May 14, 2026, 26 days before disclosure).
The latest release, 1.15.0, is not affected.
- CVE-2025-62373Critical 9.8
Pipecat vulnerable to Remote Code Execution by Pickle Deserialization via LivekitFrameSerializer
Affected: from 0.0.41, fixed in 0.0.94.
Fixed in 0.0.94 (released Nov 10, 2025, 164 days before disclosure).
The latest release, 1.15.0, is not affected.