Elvin Suleymanov

**Name of the Vulnerable Software and Affected Versions** marimo versions prior to 0.23.9 **Description** A reflected cross-site scripting issue exists in the notebook page. Unauthenticated attackers can inject arbitrary JavaScript by exploiting improper escaping of single quotes in the `file` query parameter, which is reflected into an inline JavaScript string literal. By crafting a malicious link with a payload starting with ` new `, attackers can bypass the 404 check and execute JavaScript within the origin of the victim's server, bypassing Content-Security-Policy restrictions. **Recommendations** Update to version 0.23.9 or later.