CVE-2023-35174highCWE-78

CVE-2023-35174: fallo de gravedad alta en livebook-dev livebook

Livebook Desktop's protocol handler can be exploited to execute arbitrary command on Windows

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear livebook+ Monitorear livebook

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

21Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 8.6epss 1.0%
Livebook is a web application for writing interactive and collaborative code notebooks. On Windows, it is possible to open a `livebook://` link from a browser which opens Livebook Desktop and triggers arbitrary code execution on victim's machine. Any user using Livebook Desktop on Windows is potentially vulnerable to arbitrary code execution when they expect Livebook to be opened from browser. This vulnerability has been fixed in version 0.8.2 and 0.9.3.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L
Productos afectados
livebook-dev · livebook
CVEs relacionadas — livebook-dev livebook

En el mismo producto, de las más peligrosas a las menos.

CVE-2026-66297MEDIUMUnescaped deployment environment variables in generated setup commandsEPSS 2.5%CVE-2026-68746HIGHLivebook Teams identity check fails open when the deployment group is unresolvable, allowing unauthenticated accessEPSS 1.0%CVE-2026-66881HIGHPath traversal in imported file_entries name allows arbitrary file write via URL-type entry downloadEPSS 0.6%CVE-2026-66298HIGHJS-view sandboxed output can synthesize keyboard events to trigger unconfirmed global shortcutsEPSS 0.3%CVE-2026-66885MEDIUMLivebook Teams identity callback lacks state binding, allowing login CSRFEPSS 0.2%