Quick answers
- Is CVE-2026-67618 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-67618 being exploited in the wild.
- How severe is CVE-2026-67618?
- Medium severity, with a CVSS score of 6.5, published 4 August 2026.
- Which products and versions are affected?
- Marimo before 0.23.15.
- Is there a fix for CVE-2026-67618?
- A patch was published on 2026-07-23: Fix merged in commit 1a21bd7 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-67618 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-67618?
- Check whether you run Marimo at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is a configuration injection flaw in marimo's PEP-723 inline script metadata handling. The root cause is insufficient sanitization in the `sanitize_pyproject_dict` function, allowing attackers to embed a malicious `base_url` in notebook metadata. This attacker-controlled URL is merged into the session configuration with higher precedence than operator settings, causing marimo to send API requests to the attacker's endpoint while using the operator's `OPENAI_API_KEY` environment variable for authentication. The attack requires the operator to open the malicious notebook and make an AI request, but does not require explicit cell execution. A patch was released in marimo 0.23.15 implementing additional PEP-723 sanitization and a configuration allowlist.
Affected products
- marimo marimo before 0.23.15
Timeline
- 2026-08-04: disclosed: CVE-2026-67618 published
- 2026-07-23: patched: Fix merged in commit 1a21bd7