Livebook command injection in generated deployment setup commands

high severity · published 2026-08-05

An attacker who controls deployment group environment variable values can inject shell commands into the Docker and Fly.io setup commands Livebook generates, because those values are inserted without shell escaping. Running the generated setup commands then executes the attacker's commands on your machine.

Fixed in: 0.19.9

CVE: CVE-2026-66297

Source: NVD

Am I affected?

You are affected if the installed version is older than 0.19.9. Check the version you have and update to 0.19.9 or later. The fixed version is verified against a vendor or advisory source.

Get the fix

FixLane has a reviewed fix procedure for this incident: a read-only check first, then the fix. Ask the Telegram bot, or connect an AI agent to the FixLane MCP server and call get_fix_prompt with incident id 126 and your operating system.