marimo CVE-2026-67618

Three specific conditions must align for exploitation: first, the victim must be running marimo before 0.23.15 with an AI provider API key (such as OPENAI_API_KEY) set as an environment variable in the marimo process; second, the operator must open a notebook containing an attacker-controlled base_url embedded in PEP-723 inline script metadata - the notebook does not need to appear malicious, as the injection is in metadata rather than executable cells; third, the operator must actively trigger an AI feature (code completion, AI assistant, or similar) while the crafted notebook is open, as passive notebook opening does not trigger the exfiltration. No cell execution by the operator is required - the malicious base_url is resolved at AI-request time from the already-merged session configuration. Exploitation is limited to: marimo deployments with AI features and API keys configured, operators who open notebooks from untrusted or semi-trusted authors, and environments where the specific AI features are accessible and used. Operators who run marimo without AI features, or who only open notebooks from fully trusted, audited sources, are not at risk.

The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N, score 7.1) accurately captures the threat model: the attack is network-reachable, low-complexity, requires no attacker privileges, and demands exactly one user interaction - the operator must open the notebook and invoke an AI feature. The high confidentiality impact reflects that the exfiltrated credential (OPENAI_API_KEY) is a high-value secret with direct financial and access consequences. No EPSS score is present in the provided data; risk cannot be quantified probabilistically from available sources. No CISA KEV listing is present, and no confirmed public POC exists, but VulnCheck (the reporter) published a full technical advisory, which is a meaningful intelligence signal - the mechanism is now documented and reproducible by moderately skilled researchers. Real-world risk is concentrated among organizations where: (1) operators use marimo's built-in AI features, and (2) operators may open notebooks from semi-trusted or unknown sources (e.g., GitHub, shared workspaces, data science communities). The attack is supply-chain in character - a convincing notebook shared through legitimate channels could reach many targets before detection. Risk is bounded by the requirement that the operator actively triggers an AI request while the malicious notebook is open; passive opening alone does not exfiltrate the key.

An attacker crafts a marimo notebook - plausibly a data analysis or AI demonstration script - and injects a malicious base_url (e.g., https://attacker.example.com/v1) into the PEP-723 inline script metadata block at the top of the file. The notebook is distributed to a target operator via GitHub, a notebook-sharing platform, or email. When the operator opens the notebook in their marimo installation and clicks any AI feature (code suggestion, AI chat), marimo silently resolves the attacker's endpoint and sends an HTTP request with the operator's OPENAI_API_KEY in the Authorization header, completing the exfiltration without any visible error or warning. No confirmed public POC exists, but VulnCheck's published advisory details the mechanism sufficiently for reproduction.