EUVD-2026-53602Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible attack requiring only that the victim open a notebook (UI:R); scope change (S:C) reflects the sandboxed iframe escaping to control the parent LiveView session with full CIA impact.
Primary rating from Vendor (6b3ad84c-e1a6-4bf7-a703-f496b71e49db).
CVSS VectorVendor: 6b3ad84c-e1a6-4bf7-a703-f496b71e49db
Lifecycle Timeline
4DescriptionCVE.org
Origin Validation Error vulnerability in livebook-dev livebook allows untrusted notebook output JavaScript to trigger session-wide keyboard shortcuts, including forced evaluation of all cells and runtime restart.
Livebook's JS-view feature renders notebook-defined JavaScript inside a sandboxed, cross-origin iframe specifically because that JavaScript is untrusted. The trusted iframe shell in iframe/priv/static/iframe/v5.html forwards every keydown event fired in its own window to the parent page without consulting Event.isTrusted, so an event synthesized by the untrusted script through window.dispatchEvent is forwarded exactly as a genuine keystroke would be. The parent-side relay in assets/js/hooks/js_view.js reconstructs and re-dispatches it on the live page with no further validation, and because assets/js/hooks/session.js registers the global shortcut handler on the document in the capture phase, that handler acts on the replicated event regardless of how it was produced.
Sandboxed output JavaScript can therefore drive Livebook's session-wide keyboard shortcuts. Two of them reach LivebookWeb.SessionLive and execute immediately with no confirmation: the shortcut for queueing full evaluation runs every cell in the notebook, and the shortcut for reconnecting the runtime disconnects and reconnects it, discarding in-memory state. A third shortcut deletes the focused cell behind a confirmation dialog that the user can permanently dismiss, after which it too executes silently.
Forced full evaluation is the significant consequence, because it causes the notebook's own Elixir code to run without the user choosing to evaluate anything. A user who merely opens a notebook obtained from a third party, or reached from published documentation, can have its code executed on their runtime. Livebook also mirrors cell outputs to every connected client, so a malicious output triggers in a collaborator's browser as soon as it renders.
This issue affects livebook: from 0.5.0 before 0.18.7 and from 0.19.0 before 0.19.9.
AnalysisAI
Untrusted JavaScript rendered in Livebook notebook outputs can escape the sandboxed cross-origin iframe and trigger session-wide keyboard shortcuts, causing forced execution of all notebook cells without user consent. Livebook versions 0.5.0-0.18.6 and 0.19.0-0.19.8 are affected; a user who merely opens a third-party or documentation-linked notebook can have its Elixir code automatically evaluated on their runtime. Because cell outputs are mirrored to every connected client, a single malicious notebook load can trigger the exploit simultaneously across all collaborators in the session. No public exploit or CISA KEV listing is identified at time of analysis, but the low-friction attack path - open a notebook, get code executed - represents a meaningful social-engineering risk.
Technical ContextAI
Livebook is an Elixir-based interactive notebook platform (analogous to Jupyter) with a JS-view feature that renders user-defined JavaScript inside a sandboxed, cross-origin iframe hosted at livebookusercontent.com/iframe/v5.html. The sandbox boundary is intended to isolate untrusted notebook JavaScript from the parent Livebook session. CWE-346 (Origin Validation Error) describes the root cause: the trusted iframe shell in iframe/priv/static/iframe/v5.html forwards every keydown event it observes to the parent page via postMessage without verifying Event.isTrusted. The isTrusted DOM property distinguishes genuine user-generated events (true) from programmatically synthesized events (false via window.dispatchEvent); skipping this check means malicious notebook JavaScript can call window.dispatchEvent to fabricate keystroke events that the iframe shell treats as real. The parent-side relay in assets/js/hooks/js_view.js receives these messages and re-dispatches the reconstructed event on the live Phoenix LiveView page with no further validation. The global keyboard shortcut handler in assets/js/hooks/session.js is registered on the document in the capture phase, so it intercepts and acts on every dispatched keydown regardless of synthetic origin. Two shortcuts reach LivebookWeb.SessionLive with immediate, no-confirmation execution: queue-full-evaluation (runs every cell) and runtime-reconnect (discards in-memory state). The fix, confirmed in commits 296318f, 5980e5c, and a552ce8, introduces iframe/v6.html and updates the expected SHA-256 hash, with the corrected iframe shell presumably gating forwarded events on Event.isTrusted.
RemediationAI
Upgrade to livebook 0.18.7 (for the 0.5.x-0.18.x line) or 0.19.9 (for the 0.19.x line); these are the vendor-confirmed fixed versions per the GitHub security advisory GHSA-68c2-prqg-x62g. The underlying fix replaces the iframe shell from v5.html to v6.html (confirmed in commits 296318ffdfa6e5ed7b18ad8d5a5b2af90f3cd728, 5980e5c6b71036806b3bf54101eb1d6c0f50f19c, and a552ce8f99ad348ea37061394dc950a0cebdb33e) and updates the expected SHA-256 integrity hash in iframe.js. If immediate upgrade is not possible, a compensating control is to restrict notebook sharing and disable opening of third-party or untrusted notebooks; however, Livebook does not expose a native configuration flag to disable the JS-view feature entirely, so the only reliable workaround is to avoid rendering untrusted notebooks until the patch is applied. Organizations running Livebook in collaborative or multi-user environments face the highest risk and should treat the upgrade as urgent.
Livebook is a web application for writing interactive and collaborative code notebooks. Rated critical severity (CVSS 9.
Full unauthenticated access to Livebook 0.19.7-0.19.9 is possible when a Livebook Agent or App Server's deployment group
Path traversal in Livebook's notebook import pipeline allows an attacker who supplies a crafted `.livemd` file to write
Session hijacking via OAuth CSRF in Livebook's Livebook Teams identity provider allows an organization-member attacker t
Remote command injection in livebook-dev Livebook's deployment setup command generator allows an authenticated high-priv
Same weakness CWE-346 – Origin Validation Error
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today