CVE-2026-67618: Marimo-Team Marimo

Medium severity, CVSS 6.5. EPSS: 0.3% chance of exploitation in the next 30 days.

marimo before 0.23.15 contains a configuration injection vulnerability that allows notebook authors to exfiltrate operator API keys by embedding a malicious base_url in PEP-723 inline script metadata, which is merged into session configuration with higher precedence than the operator's own settings due to insufficient sanitization in sanitize_pyproject_dict. When an operator opens the crafted notebook and makes an AI request, marimo resolves the attacker-controlled base_url from the notebook config while falling back to the operator's OPENAI_API_KEY environment variable for authentication, transmitting the API key to the attacker-controlled endpoint without requiring any cell execution.

Affected products

• Marimo-Team Marimo: before 0.23.15 (fixed in 0.23.15)

Published 2026-08-04. Last modified 2026-09-16.