CVE-2026-66298: livebook from 0.5.0 (inclusive), before 0.18.7 (exclusive), from 0.19.0 (inclusive), before 0.19.9 (exclusive), 0.5.0…

Affected technology

livebook · from 0.5.0 (inclusive), before 0.18.7 (exclusive)
livebook

livebook · from 0.19.0 (inclusive), before 0.19.9 (exclusive)
livebook

livebook · 0.5.0 to before 0.18.7, 0.19.0 to before 0.19.9
livebook-dev

livebook · 0.5.0 to before 0.18.7, 0.19.0 to before 0.19.9, 0.5.0-cuda12 to before 0.18.7-cuda12, 0.19.0-cuda12 to before 0.19.9-cuda12
livebook-dev

livebook · 844242ba80a928d0d675416d312a58003cb7771b to before *; status changes: 296318ffdfa6e5ed7b18ad8d5a5b2af90f3cd728 — unaffected, a552ce8f99ad348ea37061394dc950a0cebdb33e — unaffected, 5980e5c6b71036806b3bf54101eb1d6c0f50f19c — unaffected
livebook-dev

Component: Elixir.LivebookWeb.SessionLive
Function: 'Elixir.LivebookWeb.SessionLive':handle_event/3
File: iframe/priv/static/iframe/v5.html, assets/js/hooks/js_view.js, assets/js/hooks/session.js, lib/livebook_web/live/session_live.ex

Attack conditions (Source advisory, CVSS 4.0): Network (remote) · No privileges required · Active user interaction

What an attacker can do

Behind a confirmation dialog that the user can permanently dismiss, after which it too executes silently. Source advisory’s CVSS 4.0 assessment (base score 8.6/10) rates confidentiality, integrity and availability impact as high.