Livebook Desktop's protocol handler can be exploited to execute arbitrary command on Windows
CVE-2023-35174
8.6HIGH
What is CVE-2023-35174?
The vulnerability allows attackers to exploit Livebook Desktop on Windows systems through malicious livebook:// links opened in a web browser. This can lead to arbitrary code execution on the victim's machine, posing a significant security risk for users expecting safe operations when launching Livebook. Users are encouraged to update their Livebook Desktop to versions 0.8.2 or 0.9.3 to mitigate this risk.
Affected Version(s)
livebook >= 0.8.0, < 0.8.2 < 0.8.0, 0.8.2
livebook >= 0.9.0, < 0.9.3 < 0.9.0, 0.9.3