CVE-2026-66881: Livebook Path Traversal Vulnerability Allows Arbitrary File Write
Summary
CVE-2026-66881: Path traversal in imported file_entries name allows arbitrary file write via URL-type entry download. Affects livebook across 5 version ranges.
>= 0.11.0, < 0.18.7
>= 0.19.0, < 0.19.9
< 50f86982ebf36c22abeb379b55ec0f2859c83bb9
< acf4cb8c0c79b89c795b180f061be7de2d8b5aa9
>= c02eb984f80a543c7a52b1d882c76f56aa5be743, < 1443dd23df6e7b9203b6797f0695a807aeb81dde
Fixed in 0.18.7 or 0.19.9, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Livebook is an interactive notebook platform designed for data exploration and analysis, enabling users to write and execute code in a collaborative environment. It supports various programming languages and allows users to import and share notebooks. However, a recent vulnerability has been identified that permits unauthorized file writes due to improper validation of file entry names in imported notebooks.
Vulnerability Detail
The vulnerability stems from a relative path traversal issue in Livebook, where an attacker can exploit the file_entries metadata in a .livemd notebook to write files to arbitrary paths on the server. The validation process for file entry names is bypassed during import, allowing malicious users to specify paths that can lead to unauthorized file creation. This can result in the execution of arbitrary code or data exposure, as the attacker controls both the destination and content of the written files. The vulnerability affects Livebook versions from 0.11.0 to 0.18.7 and from 0.19.0 to 0.19.9.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 0.11.0, < 0.18.70.18.7 -
>= 0.19.0, < 0.19.90.19.9
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, users should avoid opening notebooks from untrusted sources and refrain from importing notebooks that contain URL-type file entries until the package is updated.
Conclusion
The CVE-2026-66881 vulnerability in Livebook poses a significant risk by allowing arbitrary file writes through path traversal. Users are strongly advised to update to the latest patched versions to mitigate this risk and to exercise caution when handling notebooks from untrusted sources.
See every vulnerability recorded for livebook →
FAQ
CVE-2026-66881 is a vulnerability in Livebook that allows attackers to exploit path traversal to write files to arbitrary locations on the server.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The vulnerability affects Livebook versions from 0.11.0 to 0.18.7 and from 0.19.0 to 0.19.9.
If immediate updates are not possible, avoid opening notebooks from untrusted sources and refrain from importing potentially malicious notebooks.
The CVSS score for this vulnerability is 7.0, indicating a high severity level.
Related vulnerabilities
Recent vulnerabilities recorded for livebook.
