~ / search / GHSA-564w-97r7-c6p9

GHSA-564w-97r7-c6p9

Livebook Desktop's protocol handler can be exploited to execute arbitrary command on Windows

Source: GitHub Advisory Database (reviewed) High CVE-2023-35174

Packages

EcosystemPackageAffectedFixed in
Hex livebook >= 0.8.0, < 0.8.2 0.8.2
Hex livebook >= 0.9.0, < 0.9.3 0.9.3

Details

As written in the advisory (Markdown source, shown as plain text).

On Windows, it is possible to open a `livebook://` link from a browser which opens Livebook Desktop and triggers arbitrary code execution on victim's machine. Any user using Livebook Desktop on Windows is potentially vulnerable to arbitrary code execution when they expect Livebook to be opened from browser.

References

External links from the advisory. They lead to third-party sites.