Skip to content
OpenAdvisories

Package · PyPI

marimo

3 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Feed

  • Medium 6.1
    CVE-2026-54386

    marimo < 0.23.9 XSS via file Query Parameter in assets.py

    marimo before 0.23.9 contains a reflected cross-site scripting vulnerability in the notebook page that allows unauthenticated attackers to inject arbitrary JavaScript by exploiting improper escaping of single quotes in the file query parameter reflected into …

    marimo-team marimo marimo PyPI
  • Critical 9.3
    CVE-2026-39987 Exploited Public exploit EPSS 100%

    marimo Affected by Pre-Auth Remote Code Execution via Terminal WebSocket Authentication Bypass

    marimo is a reactive Python notebook. Prior to 0.23.0, Marimo has a Pre-Auth RCE vulnerability. The terminal WebSocket endpoint /terminal/ws lacks authentication validation, allowing an unauthenticated attacker to obtain a full PTY shell and execute arbitrary…

    marimo-team marimo marimo PyPI
    KEV Apr 23, 2026
  • Medium —
    GHSA-xjv7-6w92-42r7

    marimo vulnerable to proxy abuse of /mpl/{port}/

    ### Summary The `/mpl/<port>/<route>` endpoint, which is accessible without authentication on default Marimo installations allows for external attackers to reach internal services and arbitrary ports. ### Details From our understanding, this route is used int…

    marimo PyPI