CVE-2023-35174highCWE-78

CVE-2023-35174: high-severity vulnerability in livebook-dev livebook

Livebook Desktop's protocol handler can be exploited to execute arbitrary command on Windows

Published · Updated

Follow this CVE+ Monitor livebook+ Monitor livebook

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 8.6epss 1.0%
Livebook is a web application for writing interactive and collaborative code notebooks. On Windows, it is possible to open a `livebook://` link from a browser which opens Livebook Desktop and triggers arbitrary code execution on victim's machine. Any user using Livebook Desktop on Windows is potentially vulnerable to arbitrary code execution when they expect Livebook to be opened from browser. This vulnerability has been fixed in version 0.8.2 and 0.9.3.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L
Affected products
livebook-dev · livebook
Related CVEs — livebook-dev livebook

In the same product, most dangerous first.

CVE-2026-66297MEDIUMUnescaped deployment environment variables in generated setup commandsEPSS 2.5%CVE-2026-68746HIGHLivebook Teams identity check fails open when the deployment group is unresolvable, allowing unauthenticated accessEPSS 1.0%CVE-2026-66881HIGHPath traversal in imported file_entries name allows arbitrary file write via URL-type entry downloadEPSS 0.6%CVE-2026-66298HIGHJS-view sandboxed output can synthesize keyboard events to trigger unconfirmed global shortcutsEPSS 0.3%CVE-2026-66885MEDIUMLivebook Teams identity callback lacks state binding, allowing login CSRFEPSS 0.2%