Threat database

marimo before version 0.23.15 has a code injection vulnerability in its notebook configuration handler. This flaw allows attackers to execute arbitrary commands locally by embedding a crafted MCP server entry with malicious commands inside a notebook. The vulnerability is triggered simply by opening the notebook in edit mode, without requiring authentication or execution of any notebook cells.

marimo versions prior to 0.23.15 contain a configuration injection vulnerability that allows malicious notebook authors to exfiltrate operator API keys. This occurs because attacker-controlled base_url values embedded in notebook metadata override operator settings without proper sanitization. When an operator opens a crafted notebook and makes an AI request, the operator's API key is sent to the attacker-controlled endpoint without requiring execution of notebook cells.

marimo before 0.23.9 contains a reflected cross-site scripting vulnerability in the notebook page that allows unauthenticated attackers to inject arbitrary JavaScript by exploiting improper escaping of single quotes in the file query parameter reflected into an inline JavaScript string literal. Attackers can craft a malicious link with a payload beginning with __new__ to bypass the 404 check and inject JavaScript into the page, which executes without Content-Security-Policy restrictions in the origin of a victim's marimo server.

marimo is a reactive Python notebook. Prior to 0.23.0, Marimo has a Pre-Auth RCE vulnerability. The terminal WebSocket endpoint /terminal/ws lacks authentication validation, allowing an unauthenticated attacker to obtain a full PTY shell and execute arbitrary system commands. Unlike other WebSocket endpoints (e.g., /ws) that correctly call validate_auth() for authentication, the /terminal/ws endpoint only checks the running mode and platform support before accepting connections, completely skipping authentication verification. This vulnerability is fixed in 0.23.0.