CVE-2023-35174CWE-78

Livebook Desktop's protocol handler can be exploited to execute arbitrary command on Windows

High · published June 22, 2023

CVSS v3.1
8.6
EPSS
1%
Percentile
61.8
In the wild
Unconfirmed
What it is

Livebook is a web application for writing interactive and collaborative code notebooks. On Windows, it is possible to open a `livebook://` link from a browser which opens Livebook Desktop and triggers arbitrary code execution on victim's machine. Any user using Livebook Desktop on Windows is potentially vulnerable to arbitrary code execution when they expect Livebook to be opened from browser. This vulnerability has been fixed in version 0.8.2 and 0.9.3.

The record
Technical detail
CVSS v3.1
8.6 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L
CVSS v4.0
Not supplied
EPSS
0.00979 · 61.8th percentile
Weakness
CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published
2023-06-22T13:34Z
EPSS history
Timeline
  • 22 JUN 13:34Z
    Livebook Desktop's protocol handler can be exploited to execute arbitrary command on Windows
    cvelistv5