Threats affecting pkg:pypi/marimo

Marimo versions prior to 0.23.0 contain a critical vulnerability where the /terminal/ws WebSocket endpoint lacks authentication. This allows unauthenticated attackers to gain a full PTY shell and execute arbitrary system commands remotely. The issue arises because this endpoint does not perform authentication validation unlike other endpoints. The vulnerability is fixed in version 0.23.0.