The vulnerability in livebook-dev livebook occurs in the LivebookWeb.Hub.Teams.DeploymentGroupAgentComponent module, specifically in the docker_instructions/2 and fly_instructions/4 functions. These functions interpolate deployment group environment variable values directly into shell commands without proper shell escaping. Because the values are placed inside double-quoted shell words, an attacker can inject command substitutions (e.g., $(...) or backticks) that the shell evaluates. This leads to arbitrary command execution on the client machine when a user copies and runs the generated command. The vulnerability requires the attacker to have privileges to set deployment group environment variables. Kubernetes deployment instructions are unaffected as they use YAML manifests with proper escaping. The affected versions are from 0.13.0 before 0.18.7 and from 0.19.0 before 0.19.9.

An attacker with privileges to set deployment group environment variables can inject arbitrary shell commands into deployment setup commands generated for Docker and Fly.io. These commands execute on the machine of the user who copies and runs the generated command from the Livebook web interface, potentially leading to command execution under the user's account. The vulnerability does not allow remote code execution on the server but relies on social engineering or user action to run the malicious command locally. Kubernetes deployment instructions are not vulnerable.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should carefully review any generated deployment commands before copying and executing them, especially those related to Docker and Fly.io setups. Restrict privileges to set deployment group environment variables to trusted users only to reduce risk.