CVE-2026-66297

Livebook versions 0.13.0 through 0.18.6 and 0.19.0 through 0.19.8 contain an OS command injection flaw (CWE-78) in how the web UI generates deployment setup commands: environment variable values from a deployment group are interpolated into Docker and Fly.io setup commands without shell escaping, so shell command substitutions like $(...) or backticks inside those values are evaluated, and an embedded double quote allows arbitrary additional commands. An attacker needs privileges sufficient to set deployment group environment variables (high-privilege per the CVSS score), and exploitation requires user interaction: the injected commands execute on the machine of whoever copies the generated command from the Livebook interface and runs it without review, under that user's own account. The vulnerable system itself is not compromised; the impact is high-integrity/scope code execution on the downstream machine where the command is pasted, which is reflected in the medium CVSS 4.0 score of 5.0. Kubernetes deployment instructions are not affected because they render the same values into an escaped YAML manifest rather than a shell command. No in-the-wild exploitation is known; a public security advisory (GHSA-qpjc-w5mm-73mj) exists and EPSS estimates a 1.9% chance of exploitation in the next 30 days (78th percentile), and the flaw is not in CISA KEV.

What to do: Upgrade Livebook to 0.18.7 if running a 0.18.x release, or to 0.19.9 if running a 0.19.x release; deployments on 0.13.0-0.17.x must also move to a fixed version (0.18.7 or later). Until patched, restrict who can set deployment group environment variables, audit existing values for shell metacharacters (double quotes, $(...), backticks), and manually review generated Docker/Fly.io setup commands before running them; note that the Kubernetes instructions are not affected.