CVE-2026-67618 describes a configuration injection vulnerability in marimo before version 0.23.15. The vulnerability arises from insufficient sanitization in the sanitize_pyproject_dict function, allowing an attacker to embed a malicious base_url in PEP-723 inline script metadata within a notebook. This attacker-controlled base_url is merged into the session configuration with higher precedence than the operator's own settings. When an operator opens the malicious notebook and initiates an AI request, marimo uses the attacker-controlled base_url while authenticating with the operator's OPENAI_API_KEY environment variable, resulting in the API key being transmitted to the attacker-controlled endpoint without any need for executing notebook cells.

An attacker who crafts a malicious notebook can exfiltrate the operator's API key by embedding a malicious base_url in the notebook metadata. This compromises the confidentiality of the operator's API key, potentially allowing unauthorized access to AI services or other resources tied to that key. The vulnerability does not require the operator to execute any notebook cells, increasing the risk of unnoticed key leakage.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, operators should avoid opening notebooks from untrusted sources. Monitoring for suspicious network activity related to API key usage is recommended. Follow vendor communications for updates on official patches or mitigations.