CVE-2026-67618
Received Received - Intake

Configuration Injection in Marimo Notebooks

Publication date: 2026-08-04

Last updated on: 2026-08-04

Assigner: VulnCheck

Description
marimo before 0.23.15 contains a configuration injection vulnerability that allows notebook authors to exfiltrate operator API keys by embedding a malicious base_url in PEP-723 inline script metadata, which is merged into session configuration with higher precedence than the operator's own settings due to insufficient sanitization in sanitize_pyproject_dict. When an operator opens the crafted notebook and makes an AI request, marimo resolves the attacker-controlled base_url from the notebook config while falling back to the operator's OPENAI_API_KEY environment variable for authentication, transmitting the API key to the attacker-controlled endpoint without requiring any cell execution.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-04
Last Modified
2026-08-04
Generated
2026-08-04
AI Q&A
2026-08-04
EPSS Evaluated
N/A
NVD
CVE-2026-67618
EUVD
EUVD-2026-52702

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
marimo marimo to 0.23.15 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-345 The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a configuration injection flaw in marimo versions before 0.23.15. Attackers can create malicious notebooks with PEP-723 inline script metadata containing a rogue base_url. When an operator opens the notebook and makes an AI request, marimo uses the attacker-controlled base_url from the notebook's configuration instead of the operator's own settings due to insufficient sanitization. This causes the operator's OPENAI_API_KEY environment variable to be sent to the attacker's endpoint without any cell execution required.

Detection Guidance

To detect this vulnerability, inspect marimo notebooks for PEP-723 inline script metadata containing suspicious base_url values in tool.marimo.ai.open_ai sections. Check for unauthorized configuration overrides in notebook metadata files.

Impact Analysis

If you are an operator using marimo versions before 0.23.15, an attacker could trick you into opening a crafted notebook. This would expose your OpenAI API key to the attacker, potentially leading to unauthorized use of your AI services, data breaches, or financial loss. The attack does not require executing any cells in the notebook.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection principles and HIPAA's security requirements for protected health information. Exposure of API keys may result in non-compliance with confidentiality and integrity controls mandated by these regulations.

Mitigation Strategies

Upgrade marimo to version 0.23.15 or later. Review and remove any untrusted notebooks with PEP-723 metadata. Monitor network traffic for unauthorized API key transmissions to external endpoints.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-67618. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart