CVE-2026-66298

Name of the Vulnerable Software and Affected Versions livebook versions 0.5.0 through 0.18.6 livebook versions 0.19.0 through 0.19.8

Description An origin validation error allows untrusted notebook output JavaScript to trigger session-wide keyboard shortcuts. The JS-view feature renders JavaScript in a sandboxed, cross-origin iframe. However, the iframe shell in iframe/priv/static/iframe/v5.html forwards keydown events to the parent page without verifying Event.isTrusted. Consequently, events synthesized via window.dispatchEvent are treated as genuine keystrokes. The relay in assets/js/hooks/js view.js re-dispatches these events, which are then processed by the global shortcut handler in assets/js/hooks/session.js during the capture phase.

This allows sandboxed scripts to execute shortcuts in LivebookWeb.SessionLive, such as forcing the evaluation of all cells in the notebook or restarting the runtime, which discards in-memory state. A third shortcut can delete the focused cell. The most critical impact is the forced full evaluation, which executes the notebook's Elixir code without user consent. This can occur when a user opens a notebook from a third party or published documentation, and the effect is mirrored to all connected collaborators.

Recommendations Update livebook versions 0.5.0 through 0.18.6 to version 0.18.7. Update livebook versions 0.19.0 through 0.19.8 to version 0.19.9.