PatchTheCEVCVE-2026-66298: Origin Validation Error vulnerability in livebook-dev livebook allows untrusted notebook output JavaScript to
35
Routine
HIGH 8.8UPGRADE
CVE-2026-66298 is a high-severity flaw (CVSS 8.8) affecting livebook. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
Origin Validation Error vulnerability in livebook-dev livebook allows untrusted notebook output JavaScript to trigger session-wide keyboard shortcuts, including forced evaluation of all cells and runtime restart. Livebook's JS-view feature renders notebook-defined JavaScript inside a sandboxed, cross-origin iframe specifically because that JavaScript is untrusted. The trusted iframe shell in iframe/priv/static/iframe/v5.html forwards every keydo
Why this priority
- High severity
A fixed release or distro patch exists.
Risk facts
| CVSS score | 8.8 (High) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | None |
| User interaction | Required |
| EPSS exploit chance | 0.3% (top 82%) |
| CISA exploited list | No |
| Weakness | CWE-346 |
| Published | 2026-08-05 |
| Last modified | 2026-10-23 |
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
livebook livebook UPGRADE
Affected: >= 0.5.0 and < 0.18.7 · >= 0.19.0 and < 0.19.9
Fixed in: 0.18.7, 0.19.9
Safe to downgrade to: a release before 0.5.0
1. Check installed version
apt-cache policy livebook || rpm -q livebook || livebook --version
2. UPGRADE to 0.18.7 (Debian / Ubuntu)
sudo apt update && sudo apt install --only-upgrade livebook
2. UPGRADE (RHEL / Amazon Linux / Fedora)
sudo dnf upgrade livebook
Note
Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.
3. If no update is available yet, DOWNGRADE to a release before 0.5.0 (Debian / Ubuntu)
apt-cache madison livebook
sudo apt install livebook=<VERSION_BEFORE_0.5.0>
sudo apt-mark hold livebook
3. If no update is available yet, DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list livebook
sudo dnf downgrade livebook-<VERSION_BEFORE_0.5.0>
sudo dnf versionlock add livebook
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Related CVEs
- CVE-2026-66297 HIGH 8.0 UPGRADE Improper Neutralization of Special Elements used in an OS Command (OS Command Injection) vulnerability in live
- CVE-2026-66881 HIGH 8.1 UPGRADE Relative Path Traversal vulnerability in livebook-dev livebook allows an attacker-authored notebook to write a
- CVE-2026-68746 HIGH 8.8 UPGRADE Not Failing Securely ('Failing Open') vulnerability in livebook-dev livebook allows an unauthenticated network
- CVE-2026-66885 MEDIUM 6.5 UPGRADE Cross-Site Request Forgery (CSRF) vulnerability in livebook-dev livebook allows an attacker to authenticate a