Executive Summary

This vulnerability exists in marimo versions before 0.23.9 and is a reflected cross-site scripting (XSS) issue on the notebook page.

It allows unauthenticated attackers to inject arbitrary JavaScript code by exploiting improper escaping of single quotes in the file query parameter, which is reflected into an inline JavaScript string literal.

Attackers can craft a malicious link with a payload starting with __new__ to bypass the 404 error check and inject JavaScript that executes without Content-Security-Policy restrictions in the victim's marimo server origin.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow attackers to execute arbitrary JavaScript in the context of the victim's marimo server.

Because the injected script runs without Content-Security-Policy restrictions, attackers could potentially steal sensitive information, hijack user sessions, perform actions on behalf of the user, or deliver malicious payloads.

Since the attack requires only a crafted link and no authentication, it poses a risk to any user who clicks such a link.

Useful 0 Not Useful 0