
Research
/Security News
Critical Vulnerability in NestJS Devtools: Localhost RCE via Sandbox Escape
A flawed sandbox in @nestjs/devtools-integration lets attackers run code on your machine via CSRF, leading to full Remote Code Execution (RCE).
Gemini Live Avatar is an open-source web application that aims to provide a conversational, real-time interface using voice, text, and animated avatars in the browser. While the user interface runs entirely in the browser, it depends on a backend server to handle WebSocket communication and interact with the Gemini Live API. Under the hood, the Gemini Live API enables seamless, low-latency interactions—allowing the 3D avatar to listen, speak, and react in real time, making conversations with AI feel more natural and engaging.
Gemini Live Avatar provides an interactive loop where the avatar listens, sees, responds, and reasons in real time:
User speaks, types, or shares screen/camera input.
The server receives, processes, and analyzes input streams using the Gemini Live API, which handles the request with full multimodal context—including what the avatar "sees" through shared screen or camera input.
The avatar responds instantly as Gemini-generated responses are received by the frontend and drive the avatar’s animation:
Function calling is triggered dynamically when needed:
Turn the green(any color) lights on
, turn off light
, to demonstrate how function calling can be integrated into the system.Screen and camera content can be referenced directly in user queries like:
This real-time loop enables expressive, grounded, and multimodal conversations with an avatar interface.
git clone https://github.com/haruiz/gemini-live-avatar.git
cd gemini-live-avatar
uv sync
pip install gemini-live-avatar
gemini-live-avatar --google-search-grounding --workers 1 --avatar-path https://models.readyplayer.me/<AvatarID>.glb
Then open your browser at: http://localhost:8080
This project integrates avatars from Ready Player Me, which offers fully rigged, customizable 3D characters ideal for expressive visual representation. Facial movements—including lip sync, eye tracking, and gestures—are animated in real time using the open-source Talking Head library by Mika Suominen, and are driven by responses from the Gemini Live API. Users can personalize the experience by supplying their own Ready Player Me avatar URL.
Contributions, suggestions, and pull requests are very welcome! If you'd like to contribute, please open an issue or submit a PR.
FAQs
Create a live avatar using Gemini and FastAPI
We found that gemini-live-avatar demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
/Security News
A flawed sandbox in @nestjs/devtools-integration lets attackers run code on your machine via CSRF, leading to full Remote Code Execution (RCE).
Product
Customize license detection with Socket’s new license overlays: gain control, reduce noise, and handle edge cases with precision.
Product
Socket now supports Rust and Cargo, offering package search for all users and experimental SBOM generation for enterprise projects.