CVE-2026-66298 is a high severity origin validation flaw in Livebook. Untrusted notebook output JavaScript can synthesize keystrokes that trigger session-wide shortcuts, including forced evaluation of all cells. The record scores it 8.8 and the advisory 8.6. Livebook 0.18.7 and 0.19.9 fix it.
What's affected
Livebook, from 0.5.0 before 0.18.7 and from 0.19.0 before 0.19.9. Patched versions are 0.18.7 and 0.19.9, per the project advisory and the Erlang Ecosystem Foundation entry.
Both scores are high but not identical. The record says 8.8. The Livebook GitHub advisory says High, CVSS v4 8.6. The CNA entry matches the advisory. The two numbers come from different CVSS versions and the severity band is the same.
The weakness is CWE-346. The advisory explains that Livebook runs notebook defined JavaScript in a sandboxed cross origin iframe because it is untrusted. The trusted shell page inside that iframe forwards every keydown event to the parent without checking whether the browser generated it, so an event created by the untrusted script looks like a real keystroke.
How to check if you're exposed
Find your Livebook version in the Livebook interface, or from the image tag if you run the container. For a container deployment:
docker image ls ghcr.io/livebook-dev/livebook
Compare your version with the ranges above. A version below 0.18.7 (down to the lower bound named above), or from 0.19.0 up to but not including 0.19.9, is in scope. The cuda12 image variants follow the same ranges. If you installed from Hex, check the version of the livebook package you installed.
The risk comes from opening notebooks you did not write, from third parties or from published documentation, and from collaboration, since Livebook mirrors cell outputs to every connected client. Count who in your team opens outside notebooks.
What to do now
- Upgrade Livebook to 0.18.7 or 0.19.9.
- Until you upgrade, do not run cells that render JavaScript views from notebooks you do not trust.
- Review notebooks from outside sources before you open them, and read the cells first.
- Keep Livebook instances off shared networks where you can, and restrict who can reach them.
- Paste your dependency file into the free in-browser scan at gold.safeguard.sh/scan to see which of your projects pull in an affected version.
Why it matters
An origin validation error means a component accepts input from a source without checking that the source is who it claims to be. A sandbox exists to keep untrusted code away from the host page. Here the sandbox shell forwarded events across the boundary without asking whether a human produced them.
The advisory states the significant consequence. Forced full evaluation makes the notebook's own Elixir code run without the user choosing to evaluate anything. It also lists a runtime restart that discards in memory state, and a cell deletion that goes through after a dialog the user may have dismissed for good.
That turns "open a notebook" into "run its code", which is the boundary a notebook tool has to hold. No source I reviewed says this CVE is exploited in the wild, and the record's KEV flag is false.
Quick check
What does the attacker need?
A user who opens a notebook, or a collaborator's browser that renders a malicious output. The advisory describes no need for an account on your instance.
Do the record and advisory scores conflict?
They differ, 8.8 against 8.6, and both are in the High band.
Sources
- Livebook GitHub advisory GHSA-68c2-prqg-x62g
- Erlang Ecosystem Foundation CNA entry for CVE-2026-66298
- OSV entry EEF-CVE-2026-66298
Last reviewed: 18 October 2026.
