Skip to content
OpenAdvisories

Package · PyPI

marimo

3 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Medium 6.1
    CVE-2026-54386

    marimo < 0.23.9 XSS via file Query Parameter in assets.py

    marimo before 0.23.9 contains a reflected cross-site scripting vulnerability in the notebook page that allows unauthenticated attackers to inject arbitrary JavaScript by exploiting improper escaping of single quotes in the file query parameter reflected into …

    marimo-team marimo marimo PyPI
  • Medium —
    GHSA-xjv7-6w92-42r7

    marimo vulnerable to proxy abuse of /mpl/{port}/

    ### Summary The `/mpl/<port>/<route>` endpoint, which is accessible without authentication on default Marimo installations allows for external attackers to reach internal services and arbitrary ports. ### Details From our understanding, this route is used int…

    marimo PyPI