CVE-2026-66297 is an OS command injection in Livebook's generated Docker and Fly.io deployment setup commands. The record scores it high (8.0), while the project's advisory rates it moderate (5.0). Livebook 0.18.7 and 0.19.9 fix it. Upgrade, and read generated commands before you run them.
What's affected
Livebook, from 0.13.0 before 0.18.7 and from 0.19.0 before 0.19.9. The patched versions are 0.18.7 and 0.19.9. The Kubernetes setup instructions are not affected, because they render the values into a YAML manifest with escaping.
Severity differs by source, so here are both. The record gives CVSS 8.0 (High). The Livebook GitHub advisory and the Erlang Ecosystem Foundation CNA entry rate it Moderate, with a CVSS v4 score of 5.0. The gap comes from how the scorers read the preconditions, and both are worth knowing.
The weakness is CWE-78. The advisory says the functions that build the Docker and Fly.io setup commands insert deployment group environment variable values into a double quoted shell word without escaping. An attacker needs privileges high enough to set those variables, and the code then runs on the machine of whoever runs the generated command. Livebook never runs the command by itself.
How to check if you're exposed
Find your Livebook version in the Livebook interface, or from the image tag if you run the container. For a container deployment:
docker image ls ghcr.io/livebook-dev/livebook
Compare your version with the ranges above. A version below 0.18.7 (down to the lower bound named above), or from 0.19.0 up to but not including 0.19.9, is in scope. The cuda12 image variants follow the same ranges. If you installed from Hex, check the version of the livebook package you installed.
You are only in scope if you use Livebook Teams deployment groups and someone copies the generated Docker or Fly.io setup command. If you do not use deployment groups, the affected code path is not part of your workflow.
Also review who can edit deployment group environment variables in your organization. That permission is the precondition for the attack.
What to do now
- Upgrade Livebook to 0.18.7 or 0.19.9, whichever line you follow.
- Review the people with rights to change deployment group environment variables.
- Before you run any generated setup command, read it in full, and look for command substitution or stray quotes in the values.
- Review recent changes to deployment group variables for entries that look unusual.
- Paste your dependency file into the free in-browser scan at gold.safeguard.sh/scan to see which of your projects pull in an affected version.
Why it matters
Command injection means a value meant to be data ends up inside a command that a shell interprets. In this case the shell word was inside double quotes, where a command substitution is still evaluated. The advisory says no tricks to break out of the quotes are needed.
The interesting feature is who is hurt. The person who sets the variable is the attacker, and the person who runs the command is the victim. The compromise lands on an operator's own workstation, outside the Livebook deployment, with access to that machine's files and keys. The reviewing step is the control, and the patch removes the need to rely on it.
No source I reviewed says this CVE is exploited in the wild, and the record's KEV flag is false.
Quick check
Why do the record and the advisory disagree on severity?
The record shows 8.0 High and the project advisory shows a CVSS v4 score of 5.0 Moderate. Treat the exposure as dependent on whether you use deployment groups and who can edit their variables.
Is the Kubernetes setup affected?
No. The advisory says Kubernetes instructions escape the values in a YAML manifest.
Sources
- Livebook GitHub advisory GHSA-qpjc-w5mm-73mj
- Erlang Ecosystem Foundation CNA entry for CVE-2026-66297
- OSV entry EEF-CVE-2026-66297
Last reviewed: 18 October 2026.
