RCE in Livebook
CVE-2023-35174
Livebook is a web application for writing interactive and collaborative code notebooks. On Windows, it is possible to open a `livebook://` link from a browser which opens Livebook Desktop and triggers arbitrary code execution on victim's machine. Any user using Livebook Desktop on Windows is potentially vulnerable to arbitrary code execution when they expect Livebook to be opened from browser. This vulnerability has been fixed in version 0.8.2 and 0.9.3.
Vulnerability class: Command Injection (OS Command Injection)
EPSS: 0.010 (60.7th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 8.6 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L.
Affected products
- Livebook
- Livebook-dev Livebook — versions >= 0.8.0, < 0.8.2, >= 0.9.0, < 0.9.3
- Microsoft Windows
Weakness classification (CWE)
References
- security-advisories@github.com (x_refsource_CONFIRM, Vendor Advisory)
- security-advisories@github.com (Patch, x_refsource_MISC)
- security-advisories@github.com (Patch, x_refsource_MISC)
- security-advisories@github.com (x_refsource_MISC, Release Notes)
- security-advisories@github.com (x_refsource_MISC, Release Notes)
Frequently asked questions
- What is CVE-2023-35174?
- CVE-2023-35174 is a high-severity vulnerability in Livebook, classified under OS Command Injection. CVSS score: 8.6/10. Published 2023-06-22.
- How severe is CVE-2023-35174?
- High severity. CVSS v3 base score is 8.6 out of 10.