Livebook vulnerabilities

The 'Not Failing Securely' vulnerability in Livebook allows an unauthenticated network client to gain full access to a Livebook server that enforces identity through Livebook Teams. The issue arises from improper handling of an unresolvable deployment group identifier, which disables identity enforcement and grants full privileges.

A CSRF vulnerability in Livebook allows an attacker to authenticate a victim's browser session under the attacker's own Livebook Teams identity. The OAuth callback lacks state/nonce verification, enabling session identity substitution.

A Relative Path Traversal vulnerability in Livebook allows an attacker-authored notebook to write a file with attacker-controlled content to an arbitrary path. This occurs through importing file_entries metadata from a .livemd notebook without validating file names, enabling escape from the session's temporary directory.

A vulnerability in Livebook allows untrusted notebook JavaScript to trigger session-wide keyboard shortcuts, including forced evaluation of all cells and runtime restart. The issue stems from missing validation of keyboard events in the iframe and their forwarding to the main page.

An OS Command Injection vulnerability in Livebook allows injection of commands into generated Docker and Fly.io deployment setup commands. Deployment group environment variable values are interpolated into the commands without shell escaping, enabling arbitrary command execution via the shell.