The vulnerability arises from insufficient validation of file entry names in .livemd notebooks imported into livebook. While the UI validates file entry names to be flat filenames, the import path takes the name verbatim, allowing path traversal sequences. When a URL-type file entry is fetched, the resolved path is not properly constrained within the session's temporary directory, allowing files to be written anywhere the livebook process has write permissions. This enables an attacker to write arbitrary files with attacker-controlled content on the victim's system by supplying a crafted notebook. The affected versions are livebook from 0.11.0 up to but not including 0.18.7, and from 0.19.0 up to but not including 0.19.9. There is no indication of an official patch or remediation level provided in the data. No known exploits in the wild have been reported.

An attacker can cause arbitrary files to be written on the victim's system running livebook by supplying a malicious notebook. This can lead to unauthorized file creation or modification within any location writable by the livebook process. The attack requires the victim to open the malicious notebook and trigger the file fetch, potentially leading to local compromise or persistence. No privileges or authentication are required by the attacker to prepare the malicious notebook, but the victim must open it. The vulnerability has a high severity rating with a CVSS 4.0 score of 7.0.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should avoid opening notebooks from untrusted sources. Monitoring for updates from the livebook-dev project is recommended to apply any forthcoming patches that address this path traversal issue.