Read the docs

marimo-team

Records3All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical0CVSS 9.0–10.0
CVSS high2CVSS 7.0–8.9

Exploited now

marimo-team records in CISA KEV

No marimo-team vulnerabilities are listed in CISA KEV.

Records

3 records

TI-2026-52802 CVE-2026-75149 · GHSA-gfgh-xp6v-q37q

marimo < 0.23.15 Code Injection via MCP Server Configuration

Priority MEDIUM 42

marimo before 0.23.15 contains a code injection vulnerability in the notebook configuration handler that allows attackers to execute arbitrary commands by supplying a crafted MCP server entry with an attacker-controlled…

CVSS 4.0HIGH 8.7 Network No auth User interaction EPSS 0.00962 Published 2026-08-19 Fixed in 0.23.15 CWE-94
TI-2026-47772 CVE-2026-67618 · GHSA-v9v8-jp27-55gf

marimo < 0.23.15 API Key Exfiltration via Malicious Notebook PEP-723 Metadata

Priority LOW 31

marimo before 0.23.15 contains a configuration injection vulnerability that allows notebook authors to exfiltrate operator API keys by embedding a malicious base_url in PEP-723 inline script metadata, which is merged int…

CVSS 4.0HIGH 7.1 Network No auth User interaction EPSS 0.00295 Published 2026-08-04 Fixed in 0.23.15 CWE-345
TI-2026-39264 CVE-2026-54386 · GHSA-8m59-7xv8-735h

marimo < 0.23.9 XSS via file Query Parameter in assets.py

Priority LOW 23

marimo before 0.23.9 contains a reflected cross-site scripting vulnerability in the notebook page that allows unauthenticated attackers to inject arbitrary JavaScript by exploiting improper escaping of single quotes in t…

CVSS 4.0MEDIUM 5.1 Network No auth User interaction EPSS 0.00239 Published 2026-06-17 Fixed in 0.23.9 CWE-79
Open these records in search →