Read the docs
TI-2026-47096 Aliases CVE-2026-66297

Unescaped deployment environment variables in generated setup commands

Priority MEDIUM 56CWE-78Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
Active
Attack complexity
Low
Attack requirements
Present
Impact type
Code execution
Confidentiality · integrity · availability
None · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-78.

Summary

Improper Neutralization of Special Elements used in an OS Command (OS Command Injection) vulnerability in livebook-dev livebook allows command injection into generated deployment setup commands. LivebookWeb.Hub.Teams.DeploymentGroupAgentComponent.docker_instructions/2 and LivebookWeb.Hub.Teams.DeploymentGroupAgentComponent.fly_instructions/4 in lib/livebook_web/live/hub/teams/deployment_group_agent_component.ex interpolate deployment group environment variable values into the generated Docker and Fly.io setup commands without shell escaping. The values originate from the deployment group configuration and reach the sinks through Livebook.Hubs.Dockerfile.online_docker_info/3. Both sinks place the value inside a double-quoted shell word, so a value containing a command substitution such as $(...) or backticks is evaluated by the shell without any need to break out of the quoting, and a literal double quote terminates the quoted word and allows arbitrary further tokens. The generated command is displayed in the Livebook web interface with a copy button, so a user who copies it and runs it without reviewing it first executes the injected commands on their own machine, under their own account. An attacker requires privileges sufficient to set deployment group environment variables, while the resulting code execution occurs on the machine of whoever runs the generated command. The Kubernetes instructions are not affected, because they render the same values into a YAML manifest with escaping rather than into a shell command. This issue affects livebook: from 0.13.0 before 0.18.7 and from 0.19.0 before 0.19.9.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.02414 84th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed livebook (livebook-dev): 0.18.7, 0.19.9, 0.18.7-cuda12 +1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
livebook-devlivebook0.13.0 to before 0.18.7; 0.19.0 to before 0.19.90.18.7, 0.19.9Patch availableCNA
livebook-devlivebook0.13.0 to before 0.18.7; 0.19.0 to before 0.19.9; 0.13.0-cuda12 to before 0.18.7-cuda12; 0.19.0-cuda12 to before 0.19.9-cuda120.18.7, 0.19.9, 0.18.7-cuda12, 0.19.9-cuda12Patch availableCNA
  • livebook Vendorlivebook-dev Affected 0.13.0 to before 0.18.7; 0.19.0 to before 0.19.9 Fixed in 0.18.7, 0.19.9 Patch available CNA
  • livebook Vendorlivebook-dev Affected 0.13.0 to before 0.18.7; 0.19.0 to before 0.19.9; 0.13.0-cuda12 to before 0.18.7-cuda12; 0.19.0-cuda12 to before 0.19.9-cuda12 Fixed in 0.18.7, 0.19.9, 0.18.7-cuda12, 0.19.9-cuda12 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:livebook:livebook:*:*:*:*:*:*:*:*0.13.0 to before 0.18.7; 0.19.0 to before 0.19.9Vulnerablelivebook-dev
  • cpe:2.3:a:livebook:livebook:*:*:*:*:*:*:*:* Versions 0.13.0 to before 0.18.7; 0.19.0 to before 0.19.9 Vulnerable ·livebook-dev

Remediation

  • Fix · CNA livebook (livebook-dev) Fixed in 0.18.7, 0.19.9
  • Fix · CNA livebook (livebook-dev) Fixed in 0.18.7, 0.19.9, 0.18.7-cuda12, 0.19.9-cuda12

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    livebook-dev livebook 0.18.7, 0.18.7-cuda12 and 2 more versions

    4 records Highest priority Priority MEDIUM 2 MEDIUM, 2 LOW

    Other records, highest priority first

    • TI-2026-47467 Path traversal in imported file_entries name allows arbitrary file write via URL-type entry downloadPriority MEDIUM 64
    • TI-2026-47097 JS-view sandboxed output can synthesize keyboard events to trigger unconfirmed global shortcutsPriority LOW 39
    • TI-2026-47471 Livebook Teams identity callback lacks state binding, allowing login CSRFPriority LOW 30
    Show all 4 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-66297

References

Exploit 1

Patch 3

Advisory 2

  • TI-2026-47467 Path traversal in imported file_entries name allows arbitrary file write via URL-type entry download CVSS 4.0HIGH 7.0
  • TI-2023-17619 Livebook Desktop's protocol handler can be exploited to execute arbitrary command on Windows CVSS 3.1CRITICAL 9.8
  • TI-2026-47097 JS-view sandboxed output can synthesize keyboard events to trigger unconfirmed global shortcuts CVSS 4.0HIGH 8.6
  • TI-2026-48332 Livebook Teams identity check fails open when the deployment group is unresolvable, allowing unauthenticated access CVSS 4.0HIGH 7.7
  • TI-2026-47471 Livebook Teams identity callback lacks state binding, allowing login CSRF CVSS 4.0MEDIUM 6.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences