Improper Neutralization of Special Elements used in an OS Command (OS Command Injection) vulnerability in livebook-dev livebook allows command injection into generated deployment setup commands. Liv…
High CVSS 8.0
Summary
Improper Neutralization of Special Elements used in an OS Command (OS Command Injection) vulnerability in livebook-dev livebook allows command injection into generated deployment setup commands. LivebookWeb.Hub.Teams.DeploymentGroupAgentComponent.docker_instructions/2 and LivebookWeb.Hub.Teams.DeploymentGroupAgentComponent.fly_instructions/4 in lib/livebook_web/live/hub/teams/deployment_group_agent_component.ex interpolate deployment group environment variable values into the generated Docker …
In-depth triage · Auto channel
No in-depth report has been generated yet (DR-003 v2 AI pipeline is under construction).
Affected products
- :
Sources
- NVD DATABASE
Original Links
- https://cna.erlef.org/cves/CVE-2026-66297.html Vendor Advisory
- https://github.com/livebook-dev/livebook/commit/0c2487326bbb37cb1eb43bb2f76eb93ad9f8fd6b Patch
- https://github.com/livebook-dev/livebook/commit/b2a8416d149043132fe5a14ed611e0fefc9dc9cd Patch
- https://github.com/livebook-dev/livebook/commit/f8fe9c62cb8bfc1dd0ccda4ea4a57c5e91563c85 Patch
- https://github.com/livebook-dev/livebook/security/advisories/GHSA-qpjc-w5mm-73mj Exploit
- https://osv.dev/vulnerability/EEF-CVE-2026-66297 Third Party Advisory
- https://github.com/livebook-dev/livebook/security/advisories/GHSA-qpjc-w5mm-73mj Exploit
Timeline
- nvd_ingest NVD