pion — Vulnerabilities & Security Advisories 5

Pion is a Go library primarily used for building WebRTC and peer-to-peer communication applications. Historically, it has been susceptible to multiple remote code execution vulnerabilities due to improper input validation in its ICE, DTLS, and SRTP implementations. Cross-site scripting flaws have also been prevalent in its HTML/JavaScript components. The library has faced privilege escalation issues through insecure channel bindings and authentication bypasses in its connection establishment process. While no major public incidents have been documented, its five CVEs highlight consistent risks in handling untrusted data and cryptographic operations, particularly affecting applications that process media streams or establish direct connections between clients.