Vulnerability GHSA-564w-97r7-c6p9

High Risk

3 years ago

Livebook Desktop's protocol handler can be exploited to execute arbitrary command on Windows

0.8.0 - 0.8.1 and 0.9.0 - 0.9.2

Summary

Livebook Desktop's protocol handler can be exploited to execute arbitrary command on Windows

Details

On Windows, it is possible to open a livebook:// link from a browser which opens Livebook Desktop and triggers arbitrary code execution on victim's machine.

Any user using Livebook Desktop on Windows is potentially vulnerable to arbitrary code execution when they expect Livebook to be opened from browser.

References

Related Vulnerabilities

Other vulnerabilities affecting the same packages

Unknown

3 months ago

Livebook Teams identity callback lacks state binding, allowing login CSRF

0.15.0 - 0.18.6 and 0.19.0 - 0.19.8 EEF-CVE-2026-66885

Unknown

3 months ago

JS-view sandboxed output can synthesize keyboard events to trigger unconfirmed global shortcuts

0.5.0 - 0.18.6 and 0.19.0 - 0.19.8 EEF-CVE-2026-66298

Unknown

3 months ago

Unescaped deployment environment variables in generated setup commands

0.13.0 - 0.18.6 and 0.19.0 - 0.19.8 EEF-CVE-2026-66297

Unknown

3 months ago

Path traversal in imported file_entries name allows arbitrary file write via URL-type entry download

0.11.0 - 0.18.6 and 0.19.0 - 0.19.8 EEF-CVE-2026-66881

Unknown

3 months ago

Livebook Teams identity check fails open when the deployment group is unresolvable, allowing unauthenticated access

0.19.7 - 0.19.8 EEF-CVE-2026-68746

View all vulnerabilities for these packages

Impacted packages

livebook

Timeline

Published

3 years ago

Fixed (0.8.2)

3 years ago

Fixed (0.9.3)

3 years ago

Last Modified

11 months ago