CVE-2026-67618

Name of the Vulnerable Software and Affected Versions marimo versions prior to 0.23.15

Description Configuration injection occurs due to insufficient sanitization in the sanitize pyproject dict() function. This allows notebook authors to embed a malicious base url within PEP-723 inline script metadata. Because this metadata is merged into the session configuration with higher precedence than the operator's settings, an attacker can exfiltrate API keys. When an operator opens a crafted notebook and initiates an AI request, the system uses the attacker-controlled base url while utilizing the operator's OPENAI API KEY environment variable for authentication, sending the key to the external endpoint without requiring any cell execution.

Recommendations Update to version 0.23.15 or later.