—Hex
EEF-CVE-2026-66297· CVE-2026-66297, GHSA-qpjc-w5mm-73mjUnescaped deployment environment variables in generated setup commands
Modified: 9/8/2026
package
Hex/livebook
pkg:hex/livebook
—Hex
EEF-CVE-2026-66298· CVE-2026-66298, GHSA-68c2-prqg-x62gJS-view sandboxed output can synthesize keyboard events to trigger unconfirmed global shortcuts
Modified: 9/8/2026
—Hex
EEF-CVE-2026-66881· CVE-2026-66881, GHSA-r4h8-2xpq-v48gPath traversal in imported file_entries name allows arbitrary file write via URL-type entry download
Modified: 9/8/2026
—Hex
EEF-CVE-2026-66885· CVE-2026-66885, GHSA-pvvw-28fw-c6fgLivebook Teams identity callback lacks state binding, allowing login CSRF
Modified: 9/8/2026
—Hex
EEF-CVE-2026-68746· CVE-2026-68746, GHSA-74j5-6grg-g6wjLivebook Teams identity check fails open when the deployment group is unresolvable, allowing unauthenticated access
Modified: 9/8/2026
HIGH8.6Hex
GHSA-564w-97r7-c6p9· CVE-2023-35174Livebook Desktop's protocol handler can be exploited to execute arbitrary command on Windows
Modified: 12/10/2025