Marimo
Monthly
Code injection in marimo before 0.23.15 allows an attacker who can deliver a crafted notebook file to execute arbitrary operating system commands on the victim's machine simply by having the victim open the notebook in edit mode. The vulnerability resides in the notebook configuration handler's MCP (Model Context Protocol) server entry processing: marimo reads attacker-controlled command values from the notebook's configuration and spawns them as local subprocesses before any notebook cell runs, giving the attacker immediate code execution with no further interaction required. No public exploit or CISA KEV listing has been identified at time of analysis, but the CVSS 4.0 score of 8.7 and PR:N vector reflect the low barrier to exploitation once a victim opens a malicious file.
Configuration injection in marimo before 0.23.15 enables a malicious notebook author to silently exfiltrate an operator's OpenAI API key by embedding an attacker-controlled `base_url` in PEP-723 inline script metadata, which the `sanitize_pyproject_dict` function merges into session configuration at higher precedence than the operator's own settings. When the operator opens the crafted notebook and invokes any AI feature - code completion, AI chat, or similar - marimo resolves the injected endpoint while supplying the operator's `OPENAI_API_KEY` as the Authorization credential, transmitting it to the attacker's server. Critically, no cell execution is required; the exfiltration fires on the AI request itself. No public exploit confirmed at time of analysis, though VulnCheck's detailed advisory materially lowers the reproduction barrier. Patch is available in marimo 0.23.15.
Reflected XSS in the marimo notebook server before version 0.23.9 enables unauthenticated remote attackers to inject and execute arbitrary JavaScript in the origin of a victim's marimo server by supplying a crafted `file` query parameter. The flaw stems from improper single-quote escaping in assets.py when reflecting the parameter into an inline JavaScript string literal; attackers bypass the server's 404 check by prefixing payloads with `__new__`, and execution occurs without Content-Security-Policy restrictions. No active exploitation is confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis, though the attack mechanism is straightforward for a motivated attacker targeting shared or collaborative marimo deployments.
Code injection in marimo before 0.23.15 allows an attacker who can deliver a crafted notebook file to execute arbitrary operating system commands on the victim's machine simply by having the victim open the notebook in edit mode. The vulnerability resides in the notebook configuration handler's MCP (Model Context Protocol) server entry processing: marimo reads attacker-controlled command values from the notebook's configuration and spawns them as local subprocesses before any notebook cell runs, giving the attacker immediate code execution with no further interaction required. No public exploit or CISA KEV listing has been identified at time of analysis, but the CVSS 4.0 score of 8.7 and PR:N vector reflect the low barrier to exploitation once a victim opens a malicious file.
Configuration injection in marimo before 0.23.15 enables a malicious notebook author to silently exfiltrate an operator's OpenAI API key by embedding an attacker-controlled `base_url` in PEP-723 inline script metadata, which the `sanitize_pyproject_dict` function merges into session configuration at higher precedence than the operator's own settings. When the operator opens the crafted notebook and invokes any AI feature - code completion, AI chat, or similar - marimo resolves the injected endpoint while supplying the operator's `OPENAI_API_KEY` as the Authorization credential, transmitting it to the attacker's server. Critically, no cell execution is required; the exfiltration fires on the AI request itself. No public exploit confirmed at time of analysis, though VulnCheck's detailed advisory materially lowers the reproduction barrier. Patch is available in marimo 0.23.15.
Reflected XSS in the marimo notebook server before version 0.23.9 enables unauthenticated remote attackers to inject and execute arbitrary JavaScript in the origin of a victim's marimo server by supplying a crafted `file` query parameter. The flaw stems from improper single-quote escaping in assets.py when reflecting the parameter into an inline JavaScript string literal; attackers bypass the server's 404 check by prefixing payloads with `__new__`, and execution occurs without Content-Security-Policy restrictions. No active exploitation is confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis, though the attack mechanism is straightforward for a motivated attacker targeting shared or collaborative marimo deployments.