The vulnerability in livebook-dev livebook (CVE-2026-66297) is an OS Command Injection (CWE-78) caused by improper neutralization of special elements used in OS commands. Specifically, the functions LivebookWeb.Hub.Teams.DeploymentGroupAgentComponent.docker_instructions/2 and fly_instructions/4 interpolate deployment group environment variable values directly into shell commands without shell escaping. These values are placed inside double-quoted shell words, but command substitutions like $(...) or backticks are evaluated by the shell, allowing arbitrary command execution. The generated commands are shown in the Livebook web interface with a copy button, so if a user copies and runs the command without review, injected commands execute under their user account. Exploitation requires the attacker to have privileges to set deployment group environment variables. Kubernetes deployment instructions are not vulnerable as they use YAML manifests with proper escaping. The affected versions are livebook 0.13.0 up to but not including 0.18.7, and 0.19.0 up to but not including 0.19.9.

An attacker with privileges to set deployment group environment variables can inject arbitrary shell commands into deployment setup commands generated by livebook. These commands execute on the machine of the user who copies and runs the generated command, potentially leading to unauthorized code execution under that user's privileges. The vulnerability does not allow remote code execution on the server itself but relies on social engineering or user action to run the injected commands. Kubernetes deployment instructions are unaffected.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should carefully review any generated deployment commands before executing them, especially those copied from the Livebook web interface. Restrict privileges to set deployment group environment variables to trusted users only to reduce risk.