Livebook
Monthly
Full unauthenticated access to Livebook 0.19.7-0.19.9 is possible when a Livebook Agent or App Server's deployment group is deleted from Livebook Teams while the agent is temporarily disconnected. A logic error in `Livebook.Hubs.TeamClient.handle_call/3` causes the zero-trust authentication layer to treat an unresolvable cached deployment group identifier identically to one with identity enforcement deliberately disabled, allowing any network-reachable client to read notebooks and secrets, execute code on the server runtime, and disrupt operations without authentication. No public exploit has been identified at time of analysis, and no CISA KEV listing is present, but the high confidentiality, integrity, and availability impact (CVSS 4.0: 7.7) warrants prompt patching for all Teams-connected deployments.
Session hijacking via OAuth CSRF in Livebook's Livebook Teams identity provider allows an organization-member attacker to bind a victim's browser session to the attacker's own Teams identity. Livebook versions 0.15.0 through 0.18.6 and 0.19.0 through 0.19.8 are affected when the Livebook Teams ZTA provider is configured, as the OAuth callback handler accepts any valid authorization code without verifying it was issued for the current browser session. The attacker cannot authenticate as the victim, but the victim unknowingly operates under the attacker's identity, exposing notebooks, secrets, and uploaded data to the attacker's account. No public exploit code has been identified and active exploitation has not been confirmed by CISA KEV.
Path traversal in Livebook's notebook import pipeline allows an attacker who supplies a crafted `.livemd` file to write attacker-controlled content to arbitrary filesystem paths accessible by the Livebook process. Affected versions span 0.11.0 through 0.18.6 and 0.19.0 through 0.19.8, and the attack requires no credentials on the target instance - only that the victim open the malicious notebook and trigger a URL entry fetch. No active exploitation (CISA KEV) or public proof-of-concept has been identified at time of analysis, but the attack surface is realistic given Livebook's design as a notebook-sharing platform.
Untrusted JavaScript rendered in Livebook notebook outputs can escape the sandboxed cross-origin iframe and trigger session-wide keyboard shortcuts, causing forced execution of all notebook cells without user consent. Livebook versions 0.5.0-0.18.6 and 0.19.0-0.19.8 are affected; a user who merely opens a third-party or documentation-linked notebook can have its Elixir code automatically evaluated on their runtime. Because cell outputs are mirrored to every connected client, a single malicious notebook load can trigger the exploit simultaneously across all collaborators in the session. No public exploit or CISA KEV listing is identified at time of analysis, but the low-friction attack path - open a notebook, get code executed - represents a meaningful social-engineering risk.
Remote command injection in livebook-dev Livebook's deployment setup command generator allows an authenticated high-privilege attacker to poison Docker and Fly.io setup commands displayed in the web interface, causing arbitrary shell code to execute on the machine of any user who copies and runs the generated command. Affected versions span 0.13.0 through 0.18.6 and 0.19.0 through 0.19.8. No public exploit has been identified at time of analysis, though the CVSS 4.0 score of 4.9 reflects the high privileges required and the indirect execution path through a secondary user's action.
Livebook is a web application for writing interactive and collaborative code notebooks. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This OS Command Injection vulnerability could allow attackers to execute arbitrary operating system commands on the host.
Full unauthenticated access to Livebook 0.19.7-0.19.9 is possible when a Livebook Agent or App Server's deployment group is deleted from Livebook Teams while the agent is temporarily disconnected. A logic error in `Livebook.Hubs.TeamClient.handle_call/3` causes the zero-trust authentication layer to treat an unresolvable cached deployment group identifier identically to one with identity enforcement deliberately disabled, allowing any network-reachable client to read notebooks and secrets, execute code on the server runtime, and disrupt operations without authentication. No public exploit has been identified at time of analysis, and no CISA KEV listing is present, but the high confidentiality, integrity, and availability impact (CVSS 4.0: 7.7) warrants prompt patching for all Teams-connected deployments.
Session hijacking via OAuth CSRF in Livebook's Livebook Teams identity provider allows an organization-member attacker to bind a victim's browser session to the attacker's own Teams identity. Livebook versions 0.15.0 through 0.18.6 and 0.19.0 through 0.19.8 are affected when the Livebook Teams ZTA provider is configured, as the OAuth callback handler accepts any valid authorization code without verifying it was issued for the current browser session. The attacker cannot authenticate as the victim, but the victim unknowingly operates under the attacker's identity, exposing notebooks, secrets, and uploaded data to the attacker's account. No public exploit code has been identified and active exploitation has not been confirmed by CISA KEV.
Path traversal in Livebook's notebook import pipeline allows an attacker who supplies a crafted `.livemd` file to write attacker-controlled content to arbitrary filesystem paths accessible by the Livebook process. Affected versions span 0.11.0 through 0.18.6 and 0.19.0 through 0.19.8, and the attack requires no credentials on the target instance - only that the victim open the malicious notebook and trigger a URL entry fetch. No active exploitation (CISA KEV) or public proof-of-concept has been identified at time of analysis, but the attack surface is realistic given Livebook's design as a notebook-sharing platform.
Untrusted JavaScript rendered in Livebook notebook outputs can escape the sandboxed cross-origin iframe and trigger session-wide keyboard shortcuts, causing forced execution of all notebook cells without user consent. Livebook versions 0.5.0-0.18.6 and 0.19.0-0.19.8 are affected; a user who merely opens a third-party or documentation-linked notebook can have its Elixir code automatically evaluated on their runtime. Because cell outputs are mirrored to every connected client, a single malicious notebook load can trigger the exploit simultaneously across all collaborators in the session. No public exploit or CISA KEV listing is identified at time of analysis, but the low-friction attack path - open a notebook, get code executed - represents a meaningful social-engineering risk.
Remote command injection in livebook-dev Livebook's deployment setup command generator allows an authenticated high-privilege attacker to poison Docker and Fly.io setup commands displayed in the web interface, causing arbitrary shell code to execute on the machine of any user who copies and runs the generated command. Affected versions span 0.13.0 through 0.18.6 and 0.19.0 through 0.19.8. No public exploit has been identified at time of analysis, though the CVSS 4.0 score of 4.9 reflects the high privileges required and the indirect execution path through a secondary user's action.
Livebook is a web application for writing interactive and collaborative code notebooks. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This OS Command Injection vulnerability could allow attackers to execute arbitrary operating system commands on the host.