CVE-2026-66297

Improper Neutralization of Special Elements used in an OS Command (OS Command Injection) vulnerability in livebook-dev livebook allows command injection into generated deployment setup commands. LivebookWeb.Hub.Teams.DeploymentGroupAgentComponent.docker_instructions/2 and LivebookWeb.Hub.Teams.DeploymentGroupAgentComponent.fly_instructions/4 in lib/livebook_web/live/hub/teams/deployment_group_agent_component.ex interpolate deployment group environment variable values into the generated Docker and Fly.io setup commands without shell escaping. The values originate from the deployment group configuration and reach the sinks through Livebook.Hubs.Dockerfile.online_docker_info/3. Both sinks place the value inside a double-quoted shell word, so a value containing a command substitution such as $(...) or backticks is evaluated by the shell without any need to break out of the quoting, and a literal double quote terminates the quoted word and allows arbitrary further tokens. The generated command is displayed in the Livebook web interface with a copy button, so a user who copies it and runs it without reviewing it first executes the injected commands on their own machine, under their own account. An attacker requires privileges sufficient to set deployment group environment variables, while the resulting code execution occurs on the machine of whoever runs the generated command. The Kubernetes instructions are not affected, because they render the same values into a YAML manifest with escaping rather than into a shell command. This issue affects livebook: from 0.13.0 before 0.18.7 and from 0.19.0 before 0.19.9.

• CWE-78

• https://cna.erlef.org/cves/CVE-2026-66297.html
• https://github.com/livebook-dev/livebook/commit/0c2487326bbb37cb1eb43bb2f76eb93ad9f8fd6b
• https://github.com/livebook-dev/livebook/commit/b2a8416d149043132fe5a14ed611e0fefc9dc9cd
• https://github.com/livebook-dev/livebook/commit/f8fe9c62cb8bfc1dd0ccda4ea4a57c5e91563c85
• https://github.com/livebook-dev/livebook/security/advisories/GHSA-qpjc-w5mm-73mj
• https://osv.dev/vulnerability/EEF-CVE-2026-66297
• https://github.com/livebook-dev/livebook/security/advisories/GHSA-qpjc-w5mm-73mj

Published

Aug 5, 2026

Last Modified

Aug 6, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-66275An authenticated attacker could exceed the session flow cont…6.5
• CVE-2026-66276An authenticated attacker can craft a disposition frame with…6.5
• CVE-2026-66277It was not possible to govern the maximum number of transfer…6.5
• CVE-2026-6628A flaw has been found in phili67 Ecclesia CRM up to 8.0.0. T…6.3
• CVE-2026-6629A vulnerability has been found in Metasoft 美特软件 MetaCRM up t…7.3
• CVE-2026-66296Improper Neutralization of Input During Web Page Generation …5.1
• CVE-2026-66298Origin Validation Error vulnerability in livebook-dev livebo…8.6
• CVE-2026-66299Uncontrolled Resource Consumption vulnerability in Apache To…7.5
• CVE-2026-6630A vulnerability was found in Tenda F451 1.0.0.7_cn_svn7958. …8.8
• CVE-2026-66300SNOMED International Snowstorm contains a reflected XSS vuln…5
• CVE-2026-6631A vulnerability was determined in Tenda F451 1.0.0.7_cn_svn7…8.8
• CVE-2026-66310External control of file name or path in Microsoft Edge for …7.1