CVE-2026-66297: Livebook Command Injection Vulnerability

CVE-2026-66297 Overview

CVE-2026-66297 is an OS Command Injection vulnerability [CWE-78] in livebook-dev/livebook, the interactive and collaborative code notebook for Elixir. The flaw exists in the deployment group agent component, where environment variable values are interpolated into generated Docker and Fly.io setup commands without shell escaping. An attacker with permission to set deployment group environment variables can inject shell metacharacters such as $(...) or backticks into the generated command. When another user copies the command from the Livebook web interface and executes it, arbitrary commands run on that user's machine under their account. Affected versions are 0.13.0 up to 0.18.7 and 0.19.0 up to 0.19.9.

Critical Impact
Attackers with deployment group configuration privileges can achieve arbitrary code execution on the machines of users who copy and run the generated Docker or Fly.io setup commands.

Affected Products

livebook-dev/livebook 0.13.0 through 0.18.6
livebook-dev/livebook 0.19.0 through 0.19.8
Kubernetes deployment instructions are NOT affected (values are rendered into a YAML manifest with escaping)

Discovery Timeline

2026-08-05 - CVE-2026-66297 published to NVD
2026-08-05 - Last updated in NVD database

Technical Details for CVE-2026-66297

Vulnerability Analysis

The vulnerability resides in LivebookWeb.Hub.Teams.DeploymentGroupAgentComponent.docker_instructions/2 and LivebookWeb.Hub.Teams.DeploymentGroupAgentComponent.fly_instructions/4 within lib/livebook_web/live/hub/teams/deployment_group_agent_component.ex. Both functions interpolate deployment group environment variable values into shell commands displayed to the user. The values flow from the deployment group configuration through Livebook.Hubs.Dockerfile.online_docker_info/3 and reach the shell command sinks without neutralization of shell metacharacters.

Because each value is placed inside a double-quoted shell word, shell command substitution using $(...) or backticks executes inside the quoted string. A literal double quote character in the value also terminates the quoted word and permits appending arbitrary shell tokens. The Livebook web interface presents these commands with a convenient copy button, encouraging users to paste and execute them without review.

Root Cause

The root cause is missing shell quoting in the string interpolation used to generate deployment setup commands. The original code wrapped values in double quotes and only escaped embedded double quotes, which does not neutralize command substitution or backtick expansion performed by POSIX shells inside double-quoted strings.

Attack Vector

Exploitation requires an authenticated attacker with privileges to set deployment group environment variables. The attacker stores a malicious value containing shell metacharacters. A second user views the deployment group agent instructions in the Livebook UI, clicks the copy button, and runs the command in their terminal. Code execution occurs on the victim's machine under the victim's account, not on the Livebook server.

elixir

// Patch: lib/livebook/utils.ex - shell_quote/1 helper added to safely quote shell arguments
@doc ~S"""
Quotes the given string, such that POSIX shells treat it as a single
literal argument.

This should be used whenever building shell commands that include
arbitrary values.

## Examples

    iex> Livebook.Utils.shell_quote("value")
    "'value'"

    iex> Livebook.Utils.shell_quote("$(echo hi)")
    "'$(echo hi)'"

    iex> Livebook.Utils.shell_quote("it's")
    "'it'\\''s'"

"""
@spec shell_quote(String.t()) :: String.t()
def shell_quote(string) do
  # Within single quotes the shell treats every character literally,
  # so the only character we need to handle is the single quote
  # itself. We close the quoted string, add an escaped single quote
  # and open a new quoted string.
  "'" <> String.replace(string, "'", "'\\''") <> "'"
end

Source: GitHub commit 0c24873

Detection Methods for CVE-2026-66297

Indicators of Compromise

Deployment group environment variable values containing shell metacharacters such as $(, `, ", or ;
Terminal history on developer workstations showing execution of Livebook-generated Docker or Fly.io setup commands with unexpected substrings
Unexpected child processes spawned from shells that executed a Livebook-supplied deployment command
Outbound network connections initiated shortly after a user ran a copied Livebook deployment command

Detection Strategies

Audit Livebook deployment group configurations for environment variable values that contain shell metacharacters not required by legitimate configuration
Review Livebook access logs for accounts that modified deployment group environment variables prior to a user copying the generated instructions
Correlate command-line telemetry on developer endpoints against known-good Livebook setup command templates to detect injected tokens

Monitoring Recommendations

Monitor endpoint process telemetry for shells invoking docker run or flyctl immediately followed by anomalous child processes
Alert on modifications to deployment group configuration in Livebook Teams, especially when environment variable values are added or changed
Log and review outbound connections from developer workstations that occur shortly after execution of deployment scripts sourced from web UIs

How to Mitigate CVE-2026-66297

Immediate Actions Required

Upgrade Livebook to version 0.18.7 or 0.19.9 (or later) depending on your release track
Audit all existing deployment group environment variable values for shell metacharacters and remove or sanitize any suspicious entries
Restrict permissions to set deployment group environment variables to trusted administrators only
Instruct users to review Docker and Fly.io setup commands before executing them, particularly when generated from Livebook prior to patching

Patch Information

The issue is fixed in Livebook 0.18.7 and 0.19.9. The patches introduce a Livebook.Utils.shell_quote/1 helper that wraps values in single quotes and escapes embedded single quotes, ensuring POSIX shells treat interpolated values as literal arguments. A companion fix in lib/livebook/hubs/dockerfile.ex adds escape_dockerfile_value/1 to properly escape backslashes and double quotes in Dockerfile ENV directives. See GitHub Security Advisory GHSA-qpjc-w5mm-73mj and the CNA advisory for full details.

Workarounds

Until patched, do not use the Livebook-generated Docker or Fly.io setup commands from the deployment group agent view without manual inspection
Deploy Livebook agents using Kubernetes manifests instead, as the YAML rendering path is not affected by this vulnerability
Limit the set of users who can modify deployment group environment variables to reduce the attack surface

bash

# Verify installed Livebook version and upgrade
mix escript.install hex livebook 0.19.9
# Or, when running via Docker, pin to a patched image tag
docker pull ghcr.io/livebook-dev/livebook:0.19.9