CVE-2026-54386
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk15th percentile - higher than 15% of all known CVEs
Summary
Marimo before version 0.23.9 contains a reflected cross-site scripting vulnerability in the notebook page. An unauthenticated attacker can inject arbitrary JavaScript by exploiting improper escaping of single quotes in the 'file' query parameter reflected into an inline JavaScript string literal. Attackers can craft a malicious link with a payload starting with '__new__' to bypass the 404 check and inject JavaScript that executes without Content-Security-Policy restrictions in the context of the victim's marimo server.
Risk Assessment
The risk involves the execution of arbitrary JavaScript in the victim's browser, potentially leading to session theft, notebook modification, or data exfiltration. The attack requires no authentication and can be performed by tricking a user into clicking a crafted link.
Recommendation
Immediately upgrade marimo to version 0.23.9 or later, which includes a fix for this vulnerability. Additionally, consider implementing a Content-Security-Policy to restrict the execution of unauthorized scripts.
Other vulnerabilities in marimo
See all- CVE-2026-67618Medium
marimo before 0.23.15 contains a configuration injection vulnerability that allows notebook authors to exfiltrate operator API keys by embedding a malicious base_url in PEP-723 inline script metadata. Due to insufficient sanitization in sanitize_pyproject_dict, the malicious config is merged into session configuration with higher precedence than the operator's settings. When an operator opens the crafted notebook and makes an AI request, marimo resolves the attacker-controlled base_url while using the operator's API key for authentication, transmitting the key to the attacker-controlled endpoint without requiring cell execution.
- CVE-2026-75149High
marimo before 0.23.15 contains a code injection vulnerability in the notebook configuration handler that allows attackers to execute arbitrary commands by supplying a crafted MCP server entry with an attacker-controlled command value embedded in a notebook. When the notebook is opened in edit mode, marimo launches the specified command as a local subprocess before any notebook cell is executed, requiring no authentication or cell execution to trigger the vulnerability.
Original NVD description (English source)
marimo before 0.23.9 contains a reflected cross-site scripting vulnerability in the notebook page that allows unauthenticated attackers to inject arbitrary JavaScript by exploiting improper escaping of single quotes in the file query parameter reflected into an inline JavaScript string literal. Attackers can craft a malicious link with a payload beginning with __new__ to bypass the 404 check and inject JavaScript into the page, which executes without Content-Security-Policy restrictions in the origin of a victim's marimo server.