PatchTheCEVlivebook vulnerabilities and fixes
Recent CVEs affecting livebook, with upgrade or downgrade steps. 5 tracked.
livebook has 5 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 5. Most recent: 2026-08-05. Highest priority: CVE-2026-66297 (score 54/100).
- CVE-2026-66297 HIGH 8.0 UPGRADE Improper Neutralization of Special Elements used in an OS Command (OS Command Injection) vulnerability in live
- CVE-2026-66881 HIGH 8.1 UPGRADE Relative Path Traversal vulnerability in livebook-dev livebook allows an attacker-authored notebook to write a
- CVE-2026-68746 HIGH 8.8 UPGRADE Not Failing Securely ('Failing Open') vulnerability in livebook-dev livebook allows an unauthenticated network
- CVE-2026-66298 HIGH 8.8 UPGRADE Origin Validation Error vulnerability in livebook-dev livebook allows untrusted notebook output JavaScript to
- CVE-2026-66885 MEDIUM 6.5 UPGRADE Cross-Site Request Forgery (CSRF) vulnerability in livebook-dev livebook allows an attacker to authenticate a
FAQ
How do I fix livebook vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is livebook being exploited right now?
None of the tracked livebook CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which livebook CVE should I patch first?
CVE-2026-66297 currently ranks highest (54/100): Improper Neutralization of Special Elements used in an OS Command (OS Command Injection) vulnerability in live.