marimo vulnerabilities

marimo before 0.23.15 contains a configuration injection vulnerability that allows notebook authors to exfiltrate operator API keys by embedding a malicious base_url in PEP-723 inline script metadata. Due to insufficient sanitization in sanitize_pyproject_dict, the malicious config is merged into session configuration with higher precedence than the operator's settings. When an operator opens the crafted notebook and makes an AI request, marimo resolves the attacker-controlled base_url while using the operator's API key for authentication, transmitting the key to the attacker-controlled endpoint without requiring cell execution.

marimo before 0.23.15 contains a code injection vulnerability in the notebook configuration handler that allows attackers to execute arbitrary commands by supplying a crafted MCP server entry with an attacker-controlled command value embedded in a notebook. When the notebook is opened in edit mode, marimo launches the specified command as a local subprocess before any notebook cell is executed, requiring no authentication or cell execution to trigger the vulnerability.

Marimo before version 0.23.9 contains a reflected cross-site scripting vulnerability in the notebook page. An unauthenticated attacker can inject arbitrary JavaScript by exploiting improper escaping of single quotes in the 'file' query parameter reflected into an inline JavaScript string literal. Attackers can craft a malicious link with a payload starting with '__new__' to bypass the 404 check and inject JavaScript that executes without Content-Security-Policy restrictions in the context of the victim's marimo server.