Marimo versions from 0.9.20 up to but not including 0.16.4 have an unauthenticated proxy vulnerability in the /mpl/<port>/<route> endpoint. This endpoint allows external attackers to access internal services and arbitrary ports on the local machine, potentially bypassing firewalls. The vulnerability can expose sensitive internal services such as old CUPS servers, phpMyAdmin, and RPCMapper, which may lead to data exposure or further compromise. A fix is available in version 0.16.4.