CVE-2026-66297

CVE-2026-66297 is an OS command injection in Livebook where deployment group environment variables are interpolated into Docker and Fly.io setup commands without shell escaping. The vulnerability arises in LivebookWeb.Hub.Teams.DeploymentGroupAgentComponent (docker_instructions/2, fly_instruction...

CVE-2026-66297: Improper Neutralization of Special Elements used in an OS Command

Improper Neutralization of Special Elements used in an OS Command OS Command Injection vulnerability in livebook-dev livebook allows command injection into generated deployment setup commands. LivebookWeb.Hub.Teams.DeploymentGroupAgentComponent.dockerinstructions/2 and...