Marimo-Team Marimo
4 CVEs affecting Marimo-Team Marimo. Latest disclosed: 2026-08-19. Critical: 1, High: 1.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-39987 | Critical | 9.8 | 2026-04-09 | marimo is a reactive Python notebook. Prior to 0.23.0, Marimo has a Pre-Auth RCE vulnerability. The terminal WebSocket endpoint /terminal/ws lacks authenticati… |
CVE-2026-75149 | High | 8.8 | 2026-08-19 | marimo before 0.23.15 contains a code injection vulnerability in the notebook configuration handler that allows attackers to execute arbitrary commands by supp… |
CVE-2026-67618 | Medium | 6.5 | 2026-08-04 | marimo before 0.23.15 contains a configuration injection vulnerability that allows notebook authors to exfiltrate operator API keys by embedding a malicious ba… |
CVE-2026-54386 | Medium | 6.1 | 2026-06-17 | marimo before 0.23.9 contains a reflected cross-site scripting vulnerability in the notebook page that allows unauthenticated attackers to inject arbitrary Jav… |