Vulnerabilities

Livebook versions 0.11.0 through 0.18.6 and 0.19.0 through 0.19.8 are vulnerable to a relative path traversal (CWE-23): when importing a .livemd notebook, the markdown importer takes each URL-type file entry's declared name verbatim, skipping the flat-filename validation applied elsewhere, so the name can contain '/' and '..' sequences. When the opened notebook later requests that entry's content, Livebook resolves the name beneath the session's temporary directory without a containment check, downloads the entry's URL, and writes the response body to the resolved path while creating parent directories as needed, giving the attacker control of both the destination and the contents of the file. A victim only needs to open an attacker-supplied notebook and trigger the fetch within their own authenticated session; no attacker account is required, and because URL-type entries bypass notebook stamping quarantine on import no warning is shown, allowing creation or overwriting of files anywhere the Livebook process can write (CVSS 4.0: 7.0 High, high integrity impact). No in-the-wild exploitation is known; the flaw is documented in a public GitHub advisory (GHSA-r4h8-2xpq-v48g), has a modest EPSS of 0.4%, and is fixed in 0.18.7 and 0.19.9.

Do: Upgrade to Livebook 0.18.7 (0.18 line) or 0.19.9 or later. Until patched, do not open .livemd notebooks from untrusted sources, and audit already-imported notebooks' file_entries metadata for names containing '/' or '..' whose fetch could have written files outside the session directory. Exploitation requires user interaction and no in-the-wild activity is reported, so patching at normal cadence is reasonable; also review which paths the Livebook process can write to.