Origin Validation Error in Livebook by livebook-dev

CVE-2026-66298

What is CVE-2026-66298?

The Livebook platform contains an origin validation error that allows untrusted JavaScript output from notebooks to execute session-wide keyboard shortcuts without user consent. This flaw permits unauthorized execution of critical commands, including full evaluation of notebook cells and runtime reconnection, which can lead to significant security risks. A user can unwittingly trigger harmful actions simply by accessing a compromised notebook, and the issue affects specific versions of Livebook. Malicious outputs could also impact all connected clients, highlighting the need for immediate attention to this vulnerability.

References