Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

3 records

Vendor: marimo-team Clear all filters
TI-2026-52802 CVE-2026-75149 · GHSA-gfgh-xp6v-q37q

marimo < 0.23.15 Code Injection via MCP Server Configuration

Priority MEDIUM 42

marimo before 0.23.15 contains a code injection vulnerability in the notebook configuration handler that allows attackers to execute arbitrary commands by supplying a crafted MCP server entry with an attacker-controlled…

CVSS 4.0HIGH 8.7 Network No auth User interaction EPSS 0.00962 Published 2026-08-19 Fixed in 0.23.15 CWE-94
TI-2026-47772 CVE-2026-67618 · GHSA-v9v8-jp27-55gf

marimo < 0.23.15 API Key Exfiltration via Malicious Notebook PEP-723 Metadata

Priority LOW 31

marimo before 0.23.15 contains a configuration injection vulnerability that allows notebook authors to exfiltrate operator API keys by embedding a malicious base_url in PEP-723 inline script metadata, which is merged int…

CVSS 4.0HIGH 7.1 Network No auth User interaction EPSS 0.00295 Published 2026-08-04 Fixed in 0.23.15 CWE-345
TI-2026-39264 CVE-2026-54386 · GHSA-8m59-7xv8-735h

marimo < 0.23.9 XSS via file Query Parameter in assets.py

Priority LOW 23

marimo before 0.23.9 contains a reflected cross-site scripting vulnerability in the notebook page that allows unauthenticated attackers to inject arbitrary JavaScript by exploiting improper escaping of single quotes in t…

CVSS 4.0MEDIUM 5.1 Network No auth User interaction EPSS 0.00239 Published 2026-06-17 Fixed in 0.23.9 CWE-79