livebook (Hex)

Advisories

Latest version

—

License

—

OpenSSF Scorecard

—

How to fix

Upgrading to 0.19.9 or later clears every advisory below that has a fix.

Upgrade commands

mix

{:livebook, "~> 0.19.9"} # then: mix deps.update livebook

Known vulnerabilities

Advisory	Severity	Affected	Fixed in
EEF-CVE-2026-66885 Livebook Teams identity callback lacks state binding, allowing login CSRF	Medium EPSS 0.24%	`>= 0.15.0, < 0.18.7` `>= 0.19.0, < 0.19.9`	`0.18.7` `0.19.9`
EEF-CVE-2026-66298 JS-view sandboxed output can synthesize keyboard events to trigger unconfirmed global shortcuts	High EPSS 0.27%	`>= 0.5.0, < 0.18.7` `>= 0.19.0, < 0.19.9`	`0.18.7` `0.19.9`
EEF-CVE-2026-66297 Unescaped deployment environment variables in generated setup commands	High EPSS 2.41%	`>= 0.13.0, < 0.18.7` `>= 0.19.0, < 0.19.9`	`0.18.7` `0.19.9`
EEF-CVE-2026-66881 Path traversal in imported file_entries name allows arbitrary file write via URL-type entry download	High EPSS 0.61%	`>= 0.11.0, < 0.18.7` `>= 0.19.0, < 0.19.9`	`0.18.7` `0.19.9`
EEF-CVE-2026-68746 Livebook Teams identity check fails open when the deployment group is unresolvable, allowing unauthenticated access	High EPSS 0.80%	`>= 0.19.7, < 0.19.9`	`0.19.9`
GHSA-564w-97r7-c6p9 Livebook Desktop's protocol handler can be exploited to execute arbitrary command on Windows	Critical EPSS 0.98%	`>= 0.8.0, < 0.8.2`	`0.8.2`
GHSA-564w-97r7-c6p9 Livebook Desktop's protocol handler can be exploited to execute arbitrary command on Windows	Critical EPSS 0.98%	`>= 0.9.0, < 0.9.3`	`0.9.3`

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor