EUVD-2026-37809
GHSA-8m59-7xv8-735h
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-delivered reflected XSS requires no attacker privileges but mandates victim interaction; scope changes to the browser enabling limited confidentiality and integrity impact.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
marimo before 0.23.9 contains a reflected cross-site scripting vulnerability in the notebook page that allows unauthenticated attackers to inject arbitrary JavaScript by exploiting improper escaping of single quotes in the file query parameter reflected into an inline JavaScript string literal. Attackers can craft a malicious link with a payload beginning with __new__ to bypass the 404 check and inject JavaScript into the page, which executes without Content-Security-Policy restrictions in the origin of a victim's marimo server.
AnalysisAI
Reflected XSS in the marimo notebook server before version 0.23.9 enables unauthenticated remote attackers to inject and execute arbitrary JavaScript in the origin of a victim's marimo server by supplying a crafted file query parameter. The flaw stems from improper single-quote escaping in assets.py when reflecting the parameter into an inline JavaScript string literal; attackers bypass the server's 404 check by prefixing payloads with __new__, and execution occurs without Content-Security-Policy restrictions. No active exploitation is confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis, though the attack mechanism is straightforward for a motivated attacker targeting shared or collaborative marimo deployments.
Technical ContextAI
marimo is a Python-based reactive notebook framework that serves a web interface for authoring and executing notebooks. The vulnerability resides in the HTTP handler responsible for the notebook page (identified as assets.py per the VulnCheck advisory), which takes the file query parameter and embeds it directly into an inline JavaScript string literal in the HTML response without sanitizing single-quote characters. CWE-79 (Improper Neutralization of Input During Web Page Generation) describes this root cause: user-supplied data is concatenated into a script context without context-aware encoding. The __new__ prefix is a recognized sentinel value in marimo that instructs the server to treat the request as creating a new notebook rather than loading an existing file, effectively bypassing the 404 guard that would otherwise reject unrecognized filenames. Because no Content-Security-Policy header is enforced on the notebook page, injected scripts run with full same-origin privileges. All marimo versions covered by CPE cpe:2.3:a:marimo-team:marimo:*:*:*:*:*:*:*:* before 0.23.9 are affected.
RemediationAI
Upgrade to marimo 0.23.9 or later, which resolves the vulnerability via commit fdd55c8cf6260ae23bb411dc9d9269def5cf75d6 (https://github.com/marimo-team/marimo/commit/fdd55c8cf6260ae23bb411dc9d9269def5cf75d6); the release is available at https://github.com/marimo-team/marimo/releases/tag/0.23.9. If an immediate upgrade is not feasible, restrict access to the marimo notebook server to trusted, authenticated users via a reverse proxy enforcing authentication (e.g., HTTP Basic Auth or OAuth2 proxy) - this eliminates the unauthenticated attack surface, though it does not fix the underlying escaping defect. Injecting a strict Content-Security-Policy header at the reverse proxy layer (e.g., script-src 'self') would reduce the exploitability of any XSS by blocking inline script execution, but note this may break marimo's own inline scripting and requires testing. Avoid exposing marimo servers directly to untrusted networks until the patch is applied.
Code injection in marimo before 0.23.15 allows an attacker who can deliver a crafted notebook file to execute arbitrary
Configuration injection in marimo before 0.23.15 enables a malicious notebook author to silently exfiltrate an operator'
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today