CVE-2026-66297
HighCVSS 8.0Exploitation Probability (EPSS)
Elevated risk68th percentile - higher than 68% of all known CVEs
Summary
An OS Command Injection vulnerability in Livebook allows injection of commands into generated Docker and Fly.io deployment setup commands. Deployment group environment variable values are interpolated into the commands without shell escaping, enabling arbitrary command execution via the shell.
Risk Assessment
An attacker with privileges to set deployment group environment variables can cause malicious code execution on the machine of an administrator who copies and runs the generated command without reviewing it. This could lead to account takeover or system compromise.
Recommendation
Immediately upgrade Livebook to version 0.18.7 or 0.19.9 (or later) which contains the fix. Additionally, always carefully review any generated commands for suspicious elements before executing them.
Other vulnerabilities in Livebook
See all- CVE-2026-68746High
The 'Not Failing Securely' vulnerability in Livebook allows an unauthenticated network client to gain full access to a Livebook server that enforces identity through Livebook Teams. The issue arises from improper handling of an unresolvable deployment group identifier, which disables identity enforcement and grants full privileges.
- CVE-2026-66885Medium
A CSRF vulnerability in Livebook allows an attacker to authenticate a victim's browser session under the attacker's own Livebook Teams identity. The OAuth callback lacks state/nonce verification, enabling session identity substitution.
- CVE-2026-66881High
A Relative Path Traversal vulnerability in Livebook allows an attacker-authored notebook to write a file with attacker-controlled content to an arbitrary path. This occurs through importing file_entries metadata from a .livemd notebook without validating file names, enabling escape from the session's temporary directory.
- CVE-2026-66298High
A vulnerability in Livebook allows untrusted notebook JavaScript to trigger session-wide keyboard shortcuts, including forced evaluation of all cells and runtime restart. The issue stems from missing validation of keyboard events in the iframe and their forwarding to the main page.
Original NVD description (English source)
Improper Neutralization of Special Elements used in an OS Command (OS Command Injection) vulnerability in livebook-dev livebook allows command injection into generated deployment setup commands. LivebookWeb.Hub.Teams.DeploymentGroupAgentComponent.docker_instructions/2 and LivebookWeb.Hub.Teams.DeploymentGroupAgentComponent.fly_instructions/4 in lib/livebook_web/live/hub/teams/deployment_group_agent_component.ex interpolate deployment group environment variable values into the generated Docker and Fly.io setup commands without shell escaping. The values originate from the deployment group configuration and reach the sinks through Livebook.Hubs.Dockerfile.online_docker_info/3. Both sinks place the value inside a double-quoted shell word, so a value containing a command substitution such as $(...) or backticks is evaluated by the shell without any need to break out of the quoting, and a literal double quote terminates the quoted word and allows arbitrary further tokens. The generated command is displayed in the Livebook web interface with a copy button, so a user who copies it and runs it without reviewing it first executes the injected commands on their own machine, under their own account. An attacker requires privileges sufficient to set deployment group environment variables, while the resulting code execution occurs on the machine of whoever runs the generated command. The Kubernetes instructions are not affected, because they render the same values into a YAML manifest with escaping rather than into a shell command. This issue affects livebook: from 0.13.0 before 0.18.7 and from 0.19.0 before 0.19.9.