HIGH8.6

GHSA-564w-97r7-c6p9

Livebook Desktop's protocol handler can be exploited to execute arbitrary command on Windows

Quick fix

GHSA-564w-97r7-c6p9 — livebook: upgrade to the fixed version with the command below.

mix deps.update livebook

Details

On Windows, it is possible to open a `livebook://` link from a browser which opens Livebook Desktop and triggers arbitrary code execution on victim's machine.

Any user using Livebook Desktop on Windows is potentially vulnerable to arbitrary code execution when they expect Livebook to be opened from browser.

Are you affected?

Enter the version of the package you're using.

Affected packages

Hex/livebook

Introduced in: 0.8.0Fixed in: 0.8.2

Fixmix deps.update livebook

Hex/livebook

Introduced in: 0.9.0Fixed in: 0.9.3

Fixmix deps.update livebook

References

https://github.com/livebook-dev/livebook/security/advisories/GHSA-564w-97r7-c6p9[WEB]
https://nvd.nist.gov/vuln/detail/CVE-2023-35174[ADVISORY]
https://github.com/livebook-dev/livebook/commit/2e11b59f677c6ed3b6aa82dad412a8b3406ffdf1[WEB]
https://github.com/livebook-dev/livebook/commit/beb10daaadcc765f0380e436bd7cd5f74cf086c8[WEB]
https://github.com/livebook-dev/livebook[PACKAGE]
https://github.com/livebook-dev/livebook/releases/tag/v0.8.2[WEB]
https://github.com/livebook-dev/livebook/releases/tag/v0.9.3[WEB]