# CVE-2026-67618: marimo configuration injection via PEP-723 metadata

Source: https://junglewise.ai/threats/cve-2026-67618-marimo-configuration-injection-via-pep-723-metadata  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-04. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-67618 · Severity: medium · CVSS 6.5 · Published 2026-08-04

marimo is an open-source interactive notebook platform. A configuration injection vulnerability allows notebook authors to steal API keys from operators who open malicious notebooks. When an operator opens a crafted notebook and attempts to use AI features, marimo sends their OpenAI API key to an attacker-controlled server, bypassing the need for any malicious code execution.

Technologies: [Marimo](https://junglewise.ai/threats/technologies/marimo). Vendors: [Marimo](https://junglewise.ai/threats/vendors/marimo).

## Quick answers

**Is CVE-2026-67618 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-67618 being exploited in the wild.

**How severe is CVE-2026-67618?** Medium severity, with a CVSS score of 6.5, published 4 August 2026.

**Which products and versions are affected?** Marimo before 0.23.15.

**Is there a fix for CVE-2026-67618?** A patch was published on 2026-07-23: Fix merged in commit 1a21bd7 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-67618 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-67618?** Check whether you run Marimo at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a configuration injection flaw in marimo's PEP-723 inline script metadata handling. The root cause is insufficient sanitization in the `sanitize_pyproject_dict` function, allowing attackers to embed a malicious `base_url` in notebook metadata. This attacker-controlled URL is merged into the session configuration with higher precedence than operator settings, causing marimo to send API requests to the attacker's endpoint while using the operator's `OPENAI_API_KEY` environment variable for authentication. The attack requires the operator to open the malicious notebook and make an AI request, but does not require explicit cell execution. A patch was released in marimo 0.23.15 implementing additional PEP-723 sanitization and a configuration allowlist.

## Affected products

- marimo marimo before 0.23.15

## Timeline

- 2026-08-04: disclosed: CVE-2026-67618 published
- 2026-07-23: patched: Fix merged in commit 1a21bd7

## References

- [https://github.com/marimo-team/marimo/commit/1a21bd71e258438d2511136b5edacc94c08855f4](https://github.com/marimo-team/marimo/commit/1a21bd71e258438d2511136b5edacc94c08855f4)
- [https://github.com/marimo-team/marimo/pull/10281](https://github.com/marimo-team/marimo/pull/10281)

## Related threats

- [Marimo: Pre-Auth Remote Code Execution via Terminal WebSocket Authentication Bypass](https://junglewise.ai/threats/cve-2026-39987-marimo-pre-auth-remote-code-execution-via-terminal-websocket)