EUVD-2026-52702
GHSA-v9v8-jp27-55gf
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-distributed notebook requires operator to trigger AI request (UI:R); no attacker privileges needed on target; impact is confidentiality-only via API key theft with no integrity or availability consequence.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
marimo before 0.23.15 contains a configuration injection vulnerability that allows notebook authors to exfiltrate operator API keys by embedding a malicious base_url in PEP-723 inline script metadata, which is merged into session configuration with higher precedence than the operator's own settings due to insufficient sanitization in sanitize_pyproject_dict. When an operator opens the crafted notebook and makes an AI request, marimo resolves the attacker-controlled base_url from the notebook config while falling back to the operator's OPENAI_API_KEY environment variable for authentication, transmitting the API key to the attacker-controlled endpoint without requiring any cell execution.
AnalysisAI
Configuration injection in marimo before 0.23.15 enables a malicious notebook author to silently exfiltrate an operator's OpenAI API key by embedding an attacker-controlled base_url in PEP-723 inline script metadata, which the sanitize_pyproject_dict function merges into session configuration at higher precedence than the operator's own settings. When the operator opens the crafted notebook and invokes any AI feature - code completion, AI chat, or similar - marimo resolves the injected endpoint while supplying the operator's OPENAI_API_KEY as the Authorization credential, transmitting it to the attacker's server. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Three specific conditions must align for exploitation: first, the victim must be running marimo before 0.23.15 with an AI provider API key (such as OPENAI_API_KEY) set as an environment variable in the marimo process; second, the operator must open a notebook containing an attacker-controlled `base_url` embedded in PEP-723 inline script metadata - the notebook does not need to appear malicious, as the injection is in metadata rather than executable cells; third, the operator must actively trigger an AI feature (code completion, AI assistant, or similar) while the crafted notebook is open, as passive notebook opening does not trigger the exfiltration. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N, score 7.1) accurately captures the threat model: the attack is network-reachable, low-complexity, requires no attacker privileges, and demands exactly one user interaction - the operator must open the notebook and invoke an AI feature. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker crafts a marimo notebook - plausibly a data analysis or AI demonstration script - and injects a malicious `base_url` (e.g., `https://attacker.example.com/v1`) into the PEP-723 inline script metadata block at the top of the file. The notebook is distributed to a target operator via GitHub, a notebook-sharing platform, or email. … |
| Remediation | Upgrade marimo to version 0.23.15 or later immediately; this is the vendor-released patch confirmed by the GitHub release at https://github.com/marimo-team/marimo/releases/tag/0.23.15 and the specific fix at commit 1a21bd71e258438d2511136b5edacc94c08855f4 (PR #10281). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all marimo installations running versions before 0.23.15 and identify which have active OpenAI API integration. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Code injection in marimo before 0.23.15 allows an attacker who can deliver a crafted notebook file to execute arbitrary
Reflected XSS in the marimo notebook server before version 0.23.9 enables unauthenticated remote attackers to inject and
Same technique Code Injection
View allShare
External POC / Exploit Code
Leaving vuln.today