AIKIDO-2026-890690
livebook is vulnerable to Origin Validation Error
86
CVE Score
High
Origin Validation Error
TL;DR
Livebook renders notebook-defined JavaScript inside a sandboxed cross-origin iframe, but the iframe shell forwards every keydown event to the parent page without checking Event.isTrusted. Untrusted output scripts can synthesize keyboard events and drive Livebook's global shortcuts, forcing full notebook evaluation, restarting the runtime, or deleting cells in the browser of anyone viewing the output. The fix only proxies genuine user-initiated events from JS widgets.
How do I fix this?
Upgrade the livebook library to the patch version.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you open or view untrusted notebooks that render JavaScript outputs.
Package
Versions
0.5.0 - 0.18.6
Fixed in 0.18.70.19.0 - 0.19.8
Fixed in 0.19.9Background info
livebook is vulnerable to Origin Validation Error in versions 0.5.0 - 0.18.6 and 0.19.0 - 0.19.8.
Links
GitHub Release
Fix Commits
github.com/livebook-dev/livebook/commit/296318ffdfa6e5ed7b18ad8d5a5b2af90f3cd728github.com/livebook-dev/livebook/commit/5980e5c6b71036806b3bf54101eb1d6c0f50f19cgithub.com/livebook-dev/livebook/commit/a552ce8f99ad348ea37061394dc950a0cebdb33e
Get secure today,
quickly and for free.
Secure your code, cloud, and runtime in one central system. Connect a repo to discover what the reasoning agents find in your codebase.
No credit card required | Scan results in 32 seconds.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPAuthorized© All Intel data is openly available and commercially licensed.