CVE-2026-66297

This vulnerability in Livebook (CVE-2026-66297) is fundamentally about trust exploitation, not just command injection. An attacker with deployment group configuration privileges can embed shell metacharacters into environment variable values. When Livebook renders deployment commands for Docker or Fly.io, it interpolates these values directly into a shell command and displays it with a prominent copy button — a UI element that signals 'this is trusted output from the system.' Users copy and execute the command without inspecting it, because the interface has removed the friction that would normally trigger review. The technical injection mechanism is straightforward: environment variable values are interpolated into shell templates without escaping. The double quotes used in the template stop word-splitting but permit command substitution ($(), backticks), so payloads like $(whoami) execute immediately. The fix is trivial — apply shell escaping (printf %q or equivalent) in the template before interpolation. But the deeper failure is the asymmetry with Kubernetes deployment. The same environment variable data flows through both sinks, yet Kubernetes receives proper YAML escaping while Docker/Fly render raw shell commands. This wasn't an oversight of ignorance — the team already knew how to handle this. The likely cause is that shell command generation was added later as a convenience feature and treated as 'display output' rather than 'execution,' bypassing the security rigor applied to the infrastructure-as-code path. What should you check? If you run Livebook and use deployment groups for Docker or Fly.io, audit any environment variables set in those groups. Revoke or reset credentials for any systems where those deployment commands were executed. The copy button pattern is the real vulnerability — it social-engineers users into trusting attacker-controlled input by-presenting it as system-generated output. Consider this a class of vulnerability: any tool that auto-generates execution commands from user-controlled configuration and presents them through a 'convenience' UI is doing the same thing.

Reviewed through automated stages and approved by a human before publication.