AIKIDO-2026-890690
livebook is vulnerable to Origin Validation Error
86
High Risk
This Affects:
livebookTL;DR
Livebook renders notebook-defined JavaScript inside a sandboxed cross-origin iframe, but the iframe shell forwards every keydown event to the parent page without checking Event.isTrusted. Untrusted output scripts can synthesize keyboard events and drive Livebook's global shortcuts, forcing full notebook evaluation, restarting the runtime, or deleting cells in the browser of anyone viewing the output. The fix only proxies genuine user-initiated events from JS widgets.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you open or view untrusted notebooks that render JavaScript outputs.
Background info
livebook is vulnerable to Origin Validation Error in versions 0.5.0 - 0.18.6 and 0.19.0 - 0.19.8.
How to fix this
Upgrade the livebook library to the patch version.
Links
GitHub Release
Fix Commits
github.com/livebook-dev/livebook/commit/296318ffdfa6e5ed7b18ad8d5a5b2af90f3cd728github.com/livebook-dev/livebook/commit/5980e5c6b71036806b3bf54101eb1d6c0f50f19cgithub.com/livebook-dev/livebook/commit/a552ce8f99ad348ea37061394dc950a0cebdb33e
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant