CVE-2026-66881: livebook from 0.11.0 (inclusive), before 0.18.7 (exclusive), from 0.19.0 (inclusive), before 0.19.9 (exclusive)…

Affected technology

livebook · from 0.11.0 (inclusive), before 0.18.7 (exclusive)
livebook

livebook · from 0.19.0 (inclusive), before 0.19.9 (exclusive)
livebook

livebook · 0.11.0 to before 0.18.7, 0.19.0 to before 0.19.9
livebook-dev

livebook · 0.11.0 to before 0.18.7, 0.19.0 to before 0.19.9, 0.11.0-cuda12 to before 0.18.7-cuda12, 0.19.0-cuda12 to before 0.19.9-cuda12
livebook-dev

livebook · c02eb984f80a543c7a52b1d882c76f56aa5be743 to before *; status changes: 1443dd23df6e7b9203b6797f0695a807aeb81dde — unaffected, acf4cb8c0c79b89c795b180f061be7de2d8b5aa9 — unaffected, 50f86982ebf36c22abeb379b55ec0f2859c83bb9 — unaffected
livebook-dev

Component: Elixir.Livebook.LiveMarkdown.Import, Elixir.Livebook.Session, Elixir.Livebook.FileSystem.Utils
Function: 'Elixir.Livebook.LiveMarkdown.Import':file_entry_metadata_to_attrs/1, 'Elixir.Livebook.Session':file_entry_cache_file/2, 'Elixir.Livebook.Session':to_attachment_file_entry/2, 'Elixir.Livebook.FileSystem.Utils':resolve_unix_like_path/2
File: lib/livebook/live_markdown/import.ex, lib/livebook/session.ex, lib/livebook/file_system/utils.ex

Attack conditions (Source advisory, CVSS 4.0): Network (remote) · No privileges required · Active user interaction

What an attacker can do

Source advisory’s CVSS 4.0 assessment (base score 7.0/10) rates confidentiality impact as none; integrity impact as high; availability impact as low. The description does not specify what an attacker can achieve beyond these rated impacts.