CVE-2023-35174

Livebook is a web application for writing interactive and collaborative code notebooks. On Windows, it is possible to open a `livebook://` link from a browser which opens Livebook Desktop and triggers arbitrary code execution on victim's machine. Any user using Livebook Desktop on Windows is potentially vulnerable to arbitrary code execution when they expect Livebook to be opened from browser. This vulnerability has been fixed in version 0.8.2 and 0.9.3.

• CWE-78
• CWE-78

• https://github.com/livebook-dev/livebook/commit/2e11b59f677c6ed3b6aa82dad412a8b3406ffdf1Patch
• https://github.com/livebook-dev/livebook/commit/beb10daaadcc765f0380e436bd7cd5f74cf086c8Patch
• https://github.com/livebook-dev/livebook/releases/tag/v0.8.2Release Notes
• https://github.com/livebook-dev/livebook/releases/tag/v0.9.3Release Notes
• https://github.com/livebook-dev/livebook/security/advisories/GHSA-564w-97r7-c6p9Vendor Advisory
• https://github.com/livebook-dev/livebook/commit/2e11b59f677c6ed3b6aa82dad412a8b3406ffdf1Patch
• https://github.com/livebook-dev/livebook/commit/beb10daaadcc765f0380e436bd7cd5f74cf086c8Patch
• https://github.com/livebook-dev/livebook/releases/tag/v0.8.2Release Notes
• https://github.com/livebook-dev/livebook/releases/tag/v0.9.3Release Notes
• https://github.com/livebook-dev/livebook/security/advisories/GHSA-564w-97r7-c6p9Vendor Advisory

Published

Jun 22, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-35169PHP-IMAP is a wrapper for common IMAP communication without …9.8
• CVE-2023-3517 Hitachi Vantara Pentaho Data Integration & Analytics versio…8.8
• CVE-2023-35170Rejected reason: This CVE is a duplicate of another CVE.
• CVE-2023-35171NextCloud Server and NextCloud Enterprise Server provide fil…6.1
• CVE-2023-35172NextCloud Server and NextCloud Enterprise Server provide fil…9.1
• CVE-2023-35173Nextcloud End-to-end encryption app provides all the necessa…6.5
• CVE-2023-35175Certain HP LaserJet Pro print products are potentially vulne…9.8
• CVE-2023-35176Certain HP LaserJet Pro print products are potentially vulne…8.8
• CVE-2023-35177Certain HP LaserJet Pro print products are potentially vulne…8.8
• CVE-2023-35178Certain HP LaserJet Pro print products are potentially vulne…8.8
• CVE-2023-35179 A vulnerability has been identified within Serv-U 15.4 that…7.2
• CVE-2023-3518HashiCorp Consul and Consul Enterprise 1.16.0 when using JWT…7.3