CVE-2026-66885: Cross-Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in livebook-dev livebook allows an attacker to authenticate a victim's browser session under the attacker's own Livebook Teams identity. When Livebook is configured to use Livebook Teams for identity, Livebook.ZTA.LivebookTeams.handlerequest/4 in...

CVE-2026-68746: Not Failing Securely

Not Failing Securely 'Failing Open' vulnerability in livebook-dev livebook allows an unauthenticated network client to obtain full access to a Livebook server that enforces identity through Livebook Teams. A Livebook Agent or App Server connected to Livebook Teams caches the identifier of the...

CVE-2026-66298: Origin Validation Error

Origin Validation Error vulnerability in livebook-dev livebook allows untrusted notebook output JavaScript to trigger session-wide keyboard shortcuts, including forced evaluation of all cells and runtime restart. Livebook's JS-view feature renders notebook-defined JavaScript inside a sandboxed,...

PT-2026-68318

Name of the Vulnerable Software and Affected Versions livebook versions 0.11.0 through 0.18.6 livebook versions 0.19.0 through 0.19.8 Description A Relative Path Traversal issue allows an attacker to write a file with controlled content to an arbitrary path on the system. This occurs because the...

EUVD-2023-1695

Malicious code in bioql PyPI...

CVE-2023-35174

Livebook is a web application for writing interactive and collaborative code notebooks. On Windows, it is possible to open a livebook:// link from a browser which opens Livebook Desktop and triggers arbitrary code execution on victim's machine. Any user using Livebook Desktop on Windows is...

Design/Logic Flaw

Livebook is a web application for writing interactive and collaborative code notebooks. On Windows, it is possible to open a livebook:// link from a browser which opens Livebook Desktop and triggers arbitrary code execution on victim's machine. Any user using Livebook Desktop on Windows is...

CVE-2023-35174

Livebook is a web application for writing interactive and collaborative code notebooks. On Windows, it is possible to open a "livebook://" link from a browser which opens Livebook Desktop and triggers arbitrary code execution on victim's machine. Any user using Livebook Desktop on Windows is...

CVE-2023-35174

CVE-2023-35174 affects Livebook Desktop on Windows, where opening a browser-triggered livebook:// link can execute arbitrary code on the victim’s machine. The root cause is the protocol handler invocation from the browser, enabling code execution when users expect Livebook to open. Impact is arbi...

CVE-2023-35174 Livebook Desktop's protocol handler can be exploited to execute arbitrary command on Windows

Livebook is a web application for writing interactive and collaborative code notebooks. On Windows, it is possible to open a livebook:// link from a browser which opens Livebook Desktop and triggers arbitrary code execution on victim's machine. Any user using Livebook Desktop on Windows is...

CVE-2023-35174 Livebook Desktop's protocol handler can be exploited to execute arbitrary command on Windows

Livebook is a web application for writing interactive and collaborative code notebooks. On Windows, it is possible to open a livebook:// link from a browser which opens Livebook Desktop and triggers arbitrary code execution on victim's machine. Any user using Livebook Desktop on Windows is...

CVE-2023-35174 Livebook Desktop's protocol handler can be exploited to execute arbitrary command on Windows

Livebook is a web application for writing interactive and collaborative code notebooks. On Windows, it is possible to open a livebook:// link from a browser which opens Livebook Desktop and triggers arbitrary code execution on victim's machine. Any user using Livebook Desktop on Windows is...

CVE-2023-35174: Improper Neutralization of Special Elements used in an OS Command

Livebook is a web application for writing interactive and collaborative code notebooks. On Windows, it is possible to open a livebook:// link from a browser which opens Livebook Desktop and triggers arbitrary code execution on victim's machine. Any user using Livebook Desktop on Windows is...

Livebook 操作系统命令注入漏洞

Livebook is a web application for writing interactive and collaborative code notebooks. Livebook suffers from an operating system command injection vulnerability that originates from allowing an attacker to execute arbitrary commands using Desktop's protocol handler. Affected products and version...

GHSA-564W-97R7-C6P9 Livebook Desktop's protocol handler can be exploited to execute arbitrary command on Windows

On Windows, it is possible to open a livebook:// link from a browser which opens Livebook Desktop and triggers arbitrary code execution on victim's machine. Any user using Livebook Desktop on Windows is potentially vulnerable to arbitrary code execution when they expect Livebook to be opened from...

Livebook Desktop's protocol handler can be exploited to execute arbitrary command on Windows

On Windows, it is possible to open a livebook:// link from a browser which opens Livebook Desktop and triggers arbitrary code execution on victim's machine. Any user using Livebook Desktop on Windows is potentially vulnerable to arbitrary code execution when they expect Livebook to be opened from...

PT-2023-25184 · Livebook · Livebook

Name of the Vulnerable Software and Affected Versions: Livebook versions prior to 0.8.2 Livebook versions prior to 0.9.3 Description: The issue allows arbitrary code execution on a victim's machine when a livebook:// link is opened from a browser, triggering Livebook Desktop to execute the code...