OS Command Injection Vulnerability in Livebook by Livebook Dev

CVE-2026-66297

What is CVE-2026-66297?

An OS Command Injection flaw exists in Livebook, allowing attackers to manipulate deployment group environment variables, resulting in command execution on the user's machine. The vulnerability arises from improperly escaped values in commands generated for Docker and Fly.io setups. This flaw allows an attacker with sufficient privileges to set environment variables to inject malicious commands, potentially compromising systems if users execute the displayed commands without adequate review. The Kubernetes setup instructions remain unaffected, using proper escaping methods.

References