CVE-2023-35174highCWE-78

CVE-2023-35174: falha de alta gravidade em livebook-dev livebook

Livebook Desktop's protocol handler can be exploited to execute arbitrary command on Windows

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar livebook+ Monitorar livebook

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 8.6epss 1.0%
Livebook is a web application for writing interactive and collaborative code notebooks. On Windows, it is possible to open a `livebook://` link from a browser which opens Livebook Desktop and triggers arbitrary code execution on victim's machine. Any user using Livebook Desktop on Windows is potentially vulnerable to arbitrary code execution when they expect Livebook to be opened from browser. This vulnerability has been fixed in version 0.8.2 and 0.9.3.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L
Produtos afetados
livebook-dev · livebook
CVEs relacionadas — livebook-dev livebook

No mesmo produto, das mais perigosas para as menos.

CVE-2026-66297MEDIUMUnescaped deployment environment variables in generated setup commandsEPSS 2.5%CVE-2026-68746HIGHLivebook Teams identity check fails open when the deployment group is unresolvable, allowing unauthenticated accessEPSS 1.0%CVE-2026-66881HIGHPath traversal in imported file_entries name allows arbitrary file write via URL-type entry downloadEPSS 0.6%CVE-2026-66298HIGHJS-view sandboxed output can synthesize keyboard events to trigger unconfirmed global shortcutsEPSS 0.3%CVE-2026-66885MEDIUMLivebook Teams identity callback lacks state binding, allowing login CSRFEPSS 0.2%