CVE-2026-66297: livebook from 0.13.0 (inclusive), before 0.18.7 (exclusive), from 0.19.0 (inclusive), before 0.19.9 (exclusive)…

Affected technology

livebook · from 0.13.0 (inclusive), before 0.18.7 (exclusive)
livebook

livebook · from 0.19.0 (inclusive), before 0.19.9 (exclusive)
livebook

livebook · 0.13.0 to before 0.18.7, 0.19.0 to before 0.19.9
livebook-dev

livebook · 0.13.0 to before 0.18.7, 0.19.0 to before 0.19.9, 0.13.0-cuda12 to before 0.18.7-cuda12, 0.19.0-cuda12 to before 0.19.9-cuda12
livebook-dev

livebook · 7cf4af5c10ec645f55a10f30e5661c54f6a6b319 to before *; status changes: b2a8416d149043132fe5a14ed611e0fefc9dc9cd — unaffected, 0c2487326bbb37cb1eb43bb2f76eb93ad9f8fd6b — unaffected, f8fe9c62cb8bfc1dd0ccda4ea4a57c5e91563c85 — unaffected
livebook-dev

Component: Elixir.LivebookWeb.Hub.Teams.DeploymentGroupAgentComponent
Function: 'Elixir.LivebookWeb.Hub.Teams.DeploymentGroupAgentComponent':docker_instructions/2, 'Elixir.LivebookWeb.Hub.Teams.DeploymentGroupAgentComponent':fly_instructions/4
File: lib/livebook_web/live/hub/teams/deployment_group_agent_component.ex

Attack conditions (Source advisory, CVSS 4.0): Network (remote) · High privileges required · Active user interaction

What an attacker can do

Source advisory’s CVSS 4.0 assessment (base score 5.0/10) rates confidentiality, integrity and availability impact as none. The description does not specify what an attacker can achieve beyond these rated impacts.