CVE-2026-66298: Livebook JS-view Sandbox Vulnerability Allows Keyboard Event Synthesis
Summary
CVE-2026-66298: JS-view sandboxed output can synthesize keyboard events to trigger unconfirmed global shortcuts. Affects livebook across 5 version ranges.
>= 0.5.0, < 0.18.7
>= 0.19.0, < 0.19.9
< 5980e5c6b71036806b3bf54101eb1d6c0f50f19c
>= 844242ba80a928d0d675416d312a58003cb7771b, < 296318ffdfa6e5ed7b18ad8d5a5b2af90f3cd728
< a552ce8f99ad348ea37061394dc950a0cebdb33e
Fixed in 0.18.7 or 0.19.9, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Livebook is an interactive notebook platform that enables users to write and execute code in various programming languages, primarily Elixir. It allows for collaborative coding and real-time output sharing among users. The platform's JS-view feature is designed to execute JavaScript code in a sandboxed environment to prevent untrusted scripts from affecting the host system. However, a vulnerability exists that allows untrusted JavaScript to trigger global keyboard shortcuts, leading to unintended actions.
Vulnerability Detail
The vulnerability arises from an Origin Validation Error in Livebook's handling of JavaScript output. The trusted iframe shell forwards keydown events to the parent page without validating their origin, allowing synthesized keyboard events from untrusted scripts to be treated as genuine user input. This can lead to significant consequences, such as executing all cells in a notebook without user confirmation, reconnecting the runtime and discarding in-memory state, or deleting cells without proper user interaction. The issue affects versions of Livebook from 0.5.0 to before 0.18.7 and from 0.19.0 to before 0.19.9, posing a risk to users who open notebooks from untrusted sources.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 0.5.0, < 0.18.70.18.7 -
>= 0.19.0, < 0.19.90.19.9
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, avoid opening notebooks from untrusted sources or disable the JS-view feature if possible until the package is updated to a secure version.
Conclusion
CVE-2026-66298 presents a significant risk to Livebook users by allowing untrusted JavaScript to trigger critical keyboard shortcuts without user consent. It is crucial for users to update to the latest patched versions to protect against potential exploitation.
See every vulnerability recorded for livebook →
FAQ
CVE-2026-66298 is a vulnerability in Livebook that allows untrusted JavaScript to synthesize keyboard events, potentially leading to unintended execution of notebook code.
Users can unknowingly execute code from untrusted notebooks, which may lead to data loss or exposure of sensitive information.
The vulnerability affects Livebook versions from 0.5.0 to before 0.18.7 and from 0.19.0 to before 0.19.9.
You can use Vulert, which monitors open-source vulnerabilities in real-time. Visit Vulert Scanner to check your application without needing to sign up.
The CVSS score for this vulnerability is 8.6, indicating a high severity level.
Related vulnerabilities
Recent vulnerabilities recorded for livebook.
