Skip to content
OpenAdvisories

Vendor

marimo-team

4 known vulnerabilities.

Products

marimo 4
All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Medium 6.5
    CVE-2026-67618

    marimo < 0.23.15 API Key Exfiltration via Malicious Notebook PEP-723 Metadata

    marimo before 0.23.15 contains a configuration injection vulnerability that allows notebook authors to exfiltrate operator API keys by embedding a malicious base_url in PEP-723 inline script metadata, which is merged into session configuration with higher pre…

    marimo-team marimo
  • Medium 6.1
    CVE-2026-54386

    marimo < 0.23.9 XSS via file Query Parameter in assets.py

    marimo before 0.23.9 contains a reflected cross-site scripting vulnerability in the notebook page that allows unauthenticated attackers to inject arbitrary JavaScript by exploiting improper escaping of single quotes in the file query parameter reflected into …

    marimo-team marimo marimo PyPI