CVE-2026-66298

CVE-2026-66298 concerns Livebook’s JS-view sandbox where untrusted, notebook-defined JavaScript can trigger session-wide keyboard shortcuts. The root cause is in the trusted iframe shell forwarding every keydown to the parent without checking Event.isTrusted, allowing events synthesized by the un...

CVE-2026-66298 JS-view sandboxed output can synthesize keyboard events to trigger unconfirmed global shortcuts

Origin Validation Error vulnerability in livebook-dev livebook allows untrusted notebook output JavaScript to trigger session-wide keyboard shortcuts, including forced evaluation of all cells and runtime restart. Livebook's JS-view feature renders notebook-defined JavaScript inside a sandboxed,...