CVE-2026-54386

Name of the Vulnerable Software and Affected Versions marimo versions prior to 0.23.9

Description A reflected cross-site scripting issue exists in the notebook page. Unauthenticated attackers can inject arbitrary JavaScript by exploiting improper escaping of single quotes in the file query parameter, which is reflected into an inline JavaScript string literal. By crafting a malicious link with a payload starting with new, attackers can bypass the 404 check and execute JavaScript within the origin of the victim's server, bypassing Content-Security-Policy restrictions.

Recommendations Update to version 0.23.9 or later.