CVE-2023-35174

See a problem?
Please try reporting it to the source first.
Source
https://nvd.nist.gov/vuln/detail/CVE-2023-35174
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2023-35174.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2023-35174
Aliases
Published
2023-06-22T13:34:38.492Z
Modified
2025-11-29T14:19:58.648658Z
Severity
  • 8.6 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L CVSS Calculator
Summary
Livebook Desktop's protocol handler can be exploited to execute arbitrary command on Windows
Details

Livebook is a web application for writing interactive and collaborative code notebooks. On Windows, it is possible to open a livebook:// link from a browser which opens Livebook Desktop and triggers arbitrary code execution on victim's machine. Any user using Livebook Desktop on Windows is potentially vulnerable to arbitrary code execution when they expect Livebook to be opened from browser. This vulnerability has been fixed in version 0.8.2 and 0.9.3.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-78"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/35xxx/CVE-2023-35174.json"
}
References

Affected packages

Git / github.com/livebook-dev/livebook

Affected ranges

Type
GIT
Repo
https://github.com/livebook-dev/livebook
Events
Introduced
361455cd4eb1b527e6fd04d5c51f2901cbb4ed90
Fixed
f707c63c5842adf237fd16306cedd5db964e2272
Database specific 
{
    "versions": [
        {
            "introduced": "0.8.0"
        },
        {
            "fixed": "0.8.2"
        }
    ]
}
Type
GIT
Repo
https://github.com/livebook-dev/livebook
Events
Introduced
2e340ca88c221ff4547db0644814ef70b8c79b90
Fixed
a31a2344ef9305a76f9e2f3c3dfe75163aa5cec7
Database specific 
{
    "versions": [
        {
            "introduced": "0.9.0"
        },
        {
            "fixed": "0.9.3"
        }
    ]
}

Affected versions

v0.*

v0.8.0
v0.8.1
v0.9.0
v0.9.1
v0.9.2