CVE-2026-67618
MediumCVSS 6.5Summary
marimo before 0.23.15 contains a configuration injection vulnerability that allows notebook authors to exfiltrate operator API keys by embedding a malicious base_url in PEP-723 inline script metadata. Due to insufficient sanitization in sanitize_pyproject_dict, the malicious config is merged into session configuration with higher precedence than the operator's settings. When an operator opens the crafted notebook and makes an AI request, marimo resolves the attacker-controlled base_url while using the operator's API key for authentication, transmitting the key to the attacker-controlled endpoint without requiring cell execution.
Risk Assessment
An attacker can steal operator API keys, potentially leading to unauthorized access to external services and data breaches.
Recommendation
Upgrade marimo to version 0.23.15 or later and avoid opening notebooks from untrusted sources.
Other vulnerabilities in marimo
See all- CVE-2026-75149High
marimo before 0.23.15 contains a code injection vulnerability in the notebook configuration handler that allows attackers to execute arbitrary commands by supplying a crafted MCP server entry with an attacker-controlled command value embedded in a notebook. When the notebook is opened in edit mode, marimo launches the specified command as a local subprocess before any notebook cell is executed, requiring no authentication or cell execution to trigger the vulnerability.
- CVE-2026-54386Medium
Marimo before version 0.23.9 contains a reflected cross-site scripting vulnerability in the notebook page. An unauthenticated attacker can inject arbitrary JavaScript by exploiting improper escaping of single quotes in the 'file' query parameter reflected into an inline JavaScript string literal. Attackers can craft a malicious link with a payload starting with '__new__' to bypass the 404 check and inject JavaScript that executes without Content-Security-Policy restrictions in the context of the victim's marimo server.
Original NVD description (English source)
marimo before 0.23.15 contains a configuration injection vulnerability that allows notebook authors to exfiltrate operator API keys by embedding a malicious base_url in PEP-723 inline script metadata, which is merged into session configuration with higher precedence than the operator's own settings due to insufficient sanitization in sanitize_pyproject_dict. When an operator opens the crafted notebook and makes an AI request, marimo resolves the attacker-controlled base_url from the notebook config while falling back to the operator's OPENAI_API_KEY environment variable for authentication, transmitting the API key to the attacker-controlled endpoint without requiring any cell execution.