GHSA-564w-97r7-c6p9 (CVE-2023-35174)

Details

On Windows, it is possible to open a livebook:// link from a browser which opens Livebook Desktop and triggers arbitrary code execution on victim's machine.

Any user using Livebook Desktop on Windows is potentially vulnerable to arbitrary code execution when they expect Livebook to be opened from browser.

Affected Packages

livebook

Hex

Fixed in:

0.8.2

livebook

Hex

Fixed in:

0.9.3

References

ADVISORYhttps://github.com/advisories/GHSA-564w-97r7-c6p9 PACKAGEhttps://github.com/livebook-dev/livebook WEBhttps://github.com/livebook-dev/livebook/commit/2e11b59f677c6ed3b6aa82dad412a8b3406ffdf1 WEBhttps://github.com/livebook-dev/livebook/commit/beb10daaadcc765f0380e436bd7cd5f74cf086c8 WEBhttps://github.com/livebook-dev/livebook/releases/tag/v0.8.2 WEBhttps://github.com/livebook-dev/livebook/releases/tag/v0.9.3 WEBhttps://github.com/livebook-dev/livebook/security/advisories/GHSA-564w-97r7-c6p9 ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2023-35174

GHSA-564w-97r7-c6p9

Details

Affected Packages

References

Aliases

CVSS Analysis

Related

Ecosystems

Timeline