CVE-2026-75149

marimo before 0.23.15 contains a configuration injection vulnerability that allows notebook authors to exfiltrate operator API keys by embedding a malicious base_url in PEP-723 inline script metadata. Due to insufficient sanitization in sanitize_pyproject_dict, the malicious config is merged into session configuration with higher precedence than the operator's settings. When an operator opens the crafted notebook and makes an AI request, marimo resolves the attacker-controlled base_url while using the operator's API key for authentication, transmitting the key to the attacker-controlled endpoint without requiring cell execution.

Marimo before version 0.23.9 contains a reflected cross-site scripting vulnerability in the notebook page. An unauthenticated attacker can inject arbitrary JavaScript by exploiting improper escaping of single quotes in the 'file' query parameter reflected into an inline JavaScript string literal. Attackers can craft a malicious link with a payload starting with '__new__' to bypass the 404 check and inject JavaScript that executes without Content-Security-Policy restrictions in the context of the victim's marimo server.