high CVSS 8

CVE-2026-66297·Docker vulnerability

Improper Neutralization of Special Elements used in an OS Command (OS Command Injection) vulnerability in livebook-dev livebook allows command injection into generated deployment setup commands. LivebookWeb.Hub.Teams.DeploymentGroupAgentComponent.docker_instructions/2 and LivebookWeb.Hub.Teams.DeploymentGroupAgentComponent.fly_instructions/4 in lib/livebook_web/live/hub/teams/deployment_group_agent_component.ex interpolate deployment group environment variable values into the generated Docker and Fly.io setup commands without shell escaping. The values originate from the deployment group configuration and reach the sinks through Livebook.Hubs.Dockerfile.online_docker_info/3. Both sinks place the value inside a double-quoted shell word, so a value containing a command substitution such as $(...) or backticks is evaluated by the shell without any need to break out of the quoting, and a literal double quote terminates the quoted word and allows arbitrary further tokens. The generated command is displayed in the Livebook web interface with a copy button, so a user who copies it and runs it without reviewing it first executes the injected commands on their own machine, under their own account. An attacker requires privileges sufficient to set deployment group environment variables, while the resulting code execution occurs on the machine of whoever runs the generated command. The Kubernetes instructions are not affected, because they render the same values into a YAML manifest with escaping rather than into a shell command. This issue affects livebook: from 0.13.0 before 0.18.7 and from 0.19.0 before 0.19.9.

Severity
high
Software
Docker
Fixed in
0.19.9
Published
2026-08-05

Affected versions

From: 0.19.0

Until: 0.19.9

Fixed in: 0.19.9

How to fix this CVE

Update Docker to version 0.19.9 or later to patch the OS command injection vulnerability in deployment setup command generation. The vulnerability allows attackers with deployment group configuration privileges to inject arbitrary shell commands that execute when users copy and run generated Docker or Fly.io deployment instructions. Immediately audit any deployment group environment variables for suspicious content and review command history on machines where deployment setup commands were executed.

sudo dnf update docker-ce

Defensia detects this vulnerability

WAF mitigation (if patching is not yet possible)

Add this rule to your WAF to block exploitation attempts while you schedule the patch. 

Implement WAF rules to detect and block HTTP requests containing suspicious payloads in deployment group configuration API endpoints, specifically patterns matching shell metacharacters such as $(, `, |, ;, &, and backticks in environment variable fields. Additionally, enforce strict input validation on the Livebook web interface to reject environment variable values containing command substitution syntax.

How to check if you are affected

  1. Run 'docker --version' to confirm the current Docker version installed on your system
  2. Check if Livebook is running by querying 'curl -s http://localhost:8080/health' (default port) or reviewing process list with 'ps aux | grep livebook'
  3. Search system logs for suspicious environment variable patterns: 'grep -r "\$(" /var/log/ | grep -i deployment' or 'grep -r '\`' /var/log/ | grep -i deployment'
  4. Verify the patched version is active by stopping and restarting the Docker daemon: 'sudo systemctl restart docker' and confirm with 'docker --version'

FAQ

What is CVE-2026-66297?

CVE-2026-66297 is an OS command injection vulnerability in Livebook's deployment setup command generation. When creating Docker or Fly.io deployment instructions, environment variable values are directly interpolated into shell commands without proper escaping, allowing attackers with configuration access to inject arbitrary commands executed by users who run the generated setup commands.

Is CVE-2026-66297 being actively exploited?

No, this vulnerability is not currently listed on the CISA KEV catalog and has no known public exploits, though users should still apply patches promptly as exploitation depends on social engineering rather than complexity.

What versions of Docker are affected by CVE-2026-66297?

CVE-2026-66297 affects Livebook versions 0.13.0 through 0.18.7 and 0.19.0 through 0.19.8. The fix is available in Livebook 0.19.9 and later versions.

How do I check if my server is vulnerable to CVE-2026-66297?

Run 'docker --version' and if you have Livebook installed, check the Livebook version in your deployment configuration or via the web interface settings page. Compare against the affected version ranges: 0.13.0-0.18.7 or 0.19.0-0.19.8.

Does Defensia detect CVE-2026-66297?

Yes — Defensia's CVE advisory scanner compares installed package versions against the NVD database. If Docker or Livebook is installed on a monitored server, CVE-2026-66297 will appear in your dashboard with remediation steps.

Related Docker CVEs

CVE-2026-33587CVSS 10Lack of user input sanitisation in Open Notebook v1.8.3 allows the application user to execute Python code (and subsequently OS commands) on the docker container via Server-Side Template Injection (SSTI) for user-created transformations.
CVE-2026-57572CVSS 10Crawl4AI is an open-source LLM-friendly web crawler and scraper. Prior to 0.9.0, the Docker API server accepted request-supplied browser_config.extra_args, which flowed into Chromium's launch arguments. An attacker could inject Chromium switches that replace a child-process launch command together with --no-zygote, causing Chromium to fork or exec an attacker-controlled command as the container's runtime user. The Docker API is unauthenticated by default, so a single request yields arbitrary command execution. This issue is fixed in version 0.9.0.
CVE-2026-53576CVSS 10Kestra is an open-source, event-driven orchestration platform. Prior to 1.0.45 and 1.3.21, the authentication filter for the REST API (@Filter("/api/v1/**")) treats any request whose path ends in /configs as the public instance-config endpoint and forwards it without a credential check. kestra addresses its resources by URL path segments that the caller chooses (/api/v1/{tenant}/flows/{namespace}, /api/v1/{tenant}/executions/{namespace}/{id}, /api/v1/{tenant}/namespaces/{namespace}/kv/{key}). An anonymous caller picks the literal configs as the final segment, and the request bypasses Basic-Auth entirely. Because the bypass reaches the flow-create and execution-trigger routes, an unauthenticated caller creates a flow containing a Shell or Process task and runs it. The task executes as root inside the kestra container. The official docker-compose.yml mounts /var/run/docker.sock, so root in the container reaches the host Docker daemon. This vulnerability is fixed in 1.0.45 and 1.3.21.
CVE-2026-40281CVSS 10Gotenberg is a Docker-powered stateless API for PDF files. In versions 8.30.1 and earlier, the metadata write endpoint validates metadata keys for control characters but leaves metadata values unsanitized. A newline character in a metadata value splits the ExifTool stdin line into two separate arguments, allowing injection of arbitrary ExifTool pseudo-tags such as -FileName, -Directory, -SymLink, and -HardLink. This is a bypass of the incomplete key-sanitization fix introduced in v8.30.1. An unauthenticated attacker can rename or move any PDF being processed to an arbitrary path in the container filesystem, overwrite arbitrary files, or create symlinks and hard links at arbitrary paths.
CVE-2026-44329CVSS 10free5GC is an open-source implementation of the 5G core network. Prior to 4.2.2, free5GC's SMF mounts the UPI management route group without OAuth2/bearer-token authorization middleware. A network attacker who can reach SMF on the SBI can hit UPI endpoints with no Authorization header at all, and the requests reach the SMF business handlers. In the running Docker lab this was directly demonstrated for read (GET /upi/v1/upNodesLinks), write (POST /upi/v1/upNodesLinks with attacker-controlled UP-node and link payload), and delete (DELETE /upi/v1/upNodesLinks/{nodeID}) operations. This vulnerability is fixed in 4.2.2.

References

Track CVEs across your fleet automatically

Defensia scans your Linux servers and tells you exactly which ones are running vulnerable versions — including CVE-2026-66297. Free for 1 server.

Get started free