CVE-2026-66298: Livebook Origin Validation RCE Vulnerability

CVE-2026-66298 Overview

CVE-2026-66298 is an origin validation error [CWE-346] in livebook-dev/livebook, an interactive notebook application for the Elixir programming language. Untrusted JavaScript running inside Livebook's sandboxed JS-view iframe can synthesize keydown events that the iframe shell forwards to the parent page as if they were user keystrokes. The parent relays them into the global shortcut handler without validating Event.isTrusted, allowing notebook output code to invoke session-wide shortcuts. Affected versions are 0.5.0 through 0.18.6 and 0.19.0 through 0.19.8.

Critical Impact
Opening a third-party Livebook notebook can silently trigger full-notebook evaluation, executing attacker-supplied Elixir code on the user's runtime with no confirmation.

Affected Products

Livebook >= 0.5.0, < 0.18.7
Livebook >= 0.19.0, < 0.19.9
All deployments exposing Livebook notebooks to untrusted content or collaborators

Discovery Timeline

2026-08-05 - CVE-2026-66298 published to NVD
2026-08-05 - Last updated in NVD database

Technical Details for CVE-2026-66298

Vulnerability Analysis

Livebook's JS-view feature renders notebook-defined JavaScript inside a sandboxed, cross-origin iframe because that JavaScript is untrusted. The trusted iframe shell in iframe/priv/static/iframe/v5.html forwards every keydown event fired in its own window to the parent page. It performs this forwarding without consulting Event.isTrusted, so an event synthesized by the untrusted script through window.dispatchEvent is forwarded exactly as a genuine keystroke would be.

The parent-side relay in assets/js/hooks/js_view.js reconstructs and re-dispatches the event on the live page with no further validation. Because assets/js/hooks/session.js registers the global shortcut handler on document in the capture phase, the handler acts on the replicated event regardless of how it was produced. Sandboxed output JavaScript can therefore drive Livebook's session-wide keyboard shortcuts.

Root Cause

The root cause is missing origin and trust validation on cross-frame event forwarding. The iframe-to-parent bridge treats scripted dispatchEvent output as equivalent to real user input, violating the trust boundary the sandboxed iframe was designed to enforce.

Attack Vector

An attacker publishes or shares a notebook containing malicious JS-view output. When a victim opens the notebook, the sandboxed script dispatches synthetic key events targeting Livebook shortcuts. Two shortcuts reach LivebookWeb.SessionLive and execute with no confirmation: queueing full notebook evaluation, and reconnecting the runtime. A third shortcut deletes the focused cell behind a confirmation dialog that users can permanently dismiss. Because Livebook mirrors cell outputs to every connected client, the payload also triggers in collaborators' browsers on render.

javascript

// Patched constant in assets/js/hooks/js_view/iframe.js
// The IFRAME_SHA256 pin is rotated to the fixed iframe shell that
// only proxies user-initiated events from JS widgets.

-const IFRAME_SHA256 = "wcqj5QWCo66osdAWDnEgPRFyL7nfe8oNqNggnw4vvW8=";
+const IFRAME_SHA256 = "5TLK/NpT5oNVwJIpse6ISDzNL7qqDFZAmMMo6e9vSSk=";

 export function initializeIframeSource(iframe, iframePort, iframeUrl) {
   const url = getIframeUrl(iframePort, iframeUrl);

Source: livebook commit 296318f

Detection Methods for CVE-2026-66298

Indicators of Compromise

Unexpected full-notebook evaluation runs initiated immediately after a JS-view cell renders
Runtime reconnect events tied to notebook load rather than user action
Cell deletion events occurring without an associated user confirmation prompt
Notebooks originating from third parties that embed JS-view outputs with dispatchEvent on KeyboardEvent

Detection Strategies

Audit Livebook server logs for SessionLive evaluation and runtime reconnect actions correlated with notebook open events
Review JS-view payloads in shared notebooks for calls to window.dispatchEvent constructing synthetic KeyboardEvent instances
Inventory deployed Livebook instances and flag versions in the vulnerable ranges 0.5.0–0.18.6 and 0.19.0–0.19.8

Monitoring Recommendations

Enable and centralize Livebook application logs to capture session activity, evaluation queues, and runtime lifecycle events
Alert on Livebook process activity that follows an unexpected runtime restart, since forced reconnect discards in-memory state
Monitor egress from Livebook runtime hosts for anomalous connections that may indicate executed attacker Elixir code

How to Mitigate CVE-2026-66298

Immediate Actions Required

Upgrade Livebook to 0.18.7 or 0.19.9 or later depending on the deployed branch
Do not open Livebook notebooks obtained from untrusted sources on a runtime with sensitive state or credentials
Isolate collaborative Livebook sessions until all clients are on patched builds, because outputs mirror to every connected browser

Patch Information

Fixes were shipped in commits 296318f, 5980e5c, and a552ce8. The patches rotate the iframe shell hash (IFRAME_SHA256) so the parent loads a shell that only proxies user-initiated events from JS widgets. See the GitHub Security Advisory GHSA-68c2-prqg-x62g and the Erlef CNA record for the full advisory.

Workarounds

Run Livebook in an ephemeral, network-isolated runtime when reviewing notebooks of unknown provenance
Disable or avoid JS-view cells in shared notebooks until all users are patched
Restrict Livebook access to authenticated, trusted collaborators to reduce exposure to malicious outputs mirrored across clients

bash

# Verify installed Livebook version and upgrade via Mix or escript
mix escript.install hex livebook
# or, for Docker deployments, pull a patched image tag
docker pull ghcr.io/livebook-dev/livebook:0.19.9