A high-severity origin validation vulnerability in livebook allows unauthenticated attackers to trigger unauthorized actions within a user session.

The application fails to properly validate the origin of incoming requests, allowing malicious JavaScript embedded in notebook outputs to execute commands as if they were initiated by the authenticated user. This vulnerability is triggered by an unauthenticated attacker via a crafted notebook output.

Successful exploitation allows an attacker to manipulate the livebook environment, potentially leading to unauthorized code execution through forced cell evaluation or service disruption via runtime restarts. With a CVSS score of 8.6, this flaw presents a significant risk to data integrity and operational continuity, as it grants attackers control over the computational environment of the victim.

Immediate Action: Update livebook to version 0.18.7, 0.19.9, or later versions as specified by the vendor security advisory.

Proactive Monitoring: Review application logs for unusual notebook activity or unauthorized cell evaluation triggers that deviate from standard user patterns.

Compensating Controls: Implement strict Content Security Policy (CSP) headers to limit the execution of untrusted scripts within the browser environment.

Public Exploit Available: No

The vulnerability poses a severe risk to users of the livebook platform by allowing unauthorized control of the session. Administrators should prioritize patching to the latest versions to neutralize the origin validation flaw and prevent potential session hijacking or service disruption.