CVE-2026-66881 is a high severity relative path traversal flaw in Livebook. A crafted notebook can make Livebook write a file with attacker chosen content to a path outside its cache folder. The record scores it 8.1 and the advisory 7.0. Livebook 0.18.7 and 0.19.9 fix it.
What's affected
Livebook, from 0.11.0 before 0.18.7 and from 0.19.0 before 0.19.9. Patched versions are 0.18.7 and 0.19.9.
The two sources differ on score. The record gives 8.1. The Livebook GitHub advisory rates it High with a CVSS v4 score of 7.0. Both fall in the High band, and the gap comes from different scoring versions and assumptions.
The weakness is CWE-23. The advisory describes a notebook format that can declare file entries, each with a name. Every user interface path validates that name as a flat filename. The import path does not, and it takes the name straight from the notebook source. For a URL type entry, the session then resolves the name under its temporary directory without checking that the result stays inside it.
How to check if you're exposed
Find your Livebook version in the Livebook interface, or from the image tag if you run the container. For a container deployment:
docker image ls ghcr.io/livebook-dev/livebook
Compare your version with the ranges above. A version below 0.18.7 (down to the lower bound named above), or from 0.19.0 up to but not including 0.19.9, is in scope. The cuda12 image variants follow the same ranges. If you installed from Hex, check the version of the livebook package you installed.
The exposure depends on opening notebooks from untrusted sources and then running a cell that downloads from a URL, or downloading the entry from the interface. The advisory says the attacker needs no account on the target instance. It also notes that URL type entries are not placed under the notebook stamping quarantine on import, so no warning is shown.
What to do now
- Upgrade Livebook to 0.18.7 or 0.19.9.
- Do not run download cells or fetch file entries in notebooks from sources you do not trust.
- Run Livebook as a user with limited write access, so a stray write cannot reach sensitive paths.
- For container deployments, mount only the folders that Livebook needs.
- Paste your dependency file into the free in-browser scan at gold.safeguard.sh/scan to see which of your projects pull in an affected version.
Why it matters
Path traversal turns a filename into a route out of the folder the software meant to use. When the software then writes a downloaded body to the resolved place, the attacker controls both the destination and the bytes. The advisory says the write may land anywhere the Livebook process can write.
That is why least privilege matters here. A Livebook process that can only write to its own data folder limits the damage, and one that runs as a powerful user does not. The advisory names a sibling function that already performs the containment check these paths lacked, so the fix follows a pattern the codebase already used.
No source I reviewed says this CVE is exploited in the wild, and the record's KEV flag is false.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Does the attacker need an account on my Livebook?
No. The advisory says the victim triggers the write within their own session after opening the attacker's notebook.
Are Docker images affected?
Yes, the advisory lists the container images, including the cuda12 variants, in the same version ranges.
Sources
- Livebook GitHub advisory GHSA-r4h8-2xpq-v48g
- Erlang Ecosystem Foundation CNA entry for CVE-2026-66881
- OSV entry EEF-CVE-2026-66881
Last reviewed: 18 October 2026.
