Executive brief
marimo is a Python notebook environment used for interactive data analysis and visualization. A vulnerability in versions before 0.23.15 allows attackers to execute arbitrary commands on a user's computer by crafting a malicious notebook file with specially modified configuration settings. Simply opening such a notebook in edit mode triggers the attack without requiring the user to run any code, potentially allowing installation of malware or theft of sensitive data.
Technical details
The vulnerability is a code injection flaw in marimo's notebook configuration handler that processes PEP 723 script metadata. The root cause lies in insufficient sanitization of MCP (Model Context Protocol) server entries during notebook deserialization. An attacker can embed arbitrary command payloads in a notebook's configuration, which are executed as local subprocess calls during notebook initialization in edit mode, before any notebook cells are parsed or executed. No authentication or user interaction beyond opening the notebook is required. The fix involves additional PEP 723 configuration sanitization and validation of allowed configuration keys (commit 1a21bd7, PR #10281).
Affected products
- marimo-team marimo before 0.23.15
Timeline
- 2026-08-19: disclosed
- 2026-07-23: patched: Fix merged in PR #10281 with commit 1a21bd7