CVE-2026-54386
marimo < 0.23.9 XSS via file Query Parameter in assets.py
CVSS Score
6.1
EPSS Score
0.0%
EPSS Percentile
0th
marimo before 0.23.9 contains a reflected cross-site scripting vulnerability in the notebook page that allows unauthenticated attackers to inject arbitrary JavaScript by exploiting improper escaping of single quotes in the file query parameter reflected into an inline JavaScript string literal. Attackers can craft a malicious link with a payload beginning with __new__ to bypass the 404 check and inject JavaScript into the page, which executes without Content-Security-Policy restrictions in the origin of a victim's marimo server.
| CWE | CWE-79 |
| Vendor | marimo-team |
| Product | marimo |
| Published | Jun 17, 2026 |
Stay Ahead of the Next One
Get instant alerts for marimo-team marimo
Be the first to know when new medium vulnerabilities affecting marimo-team marimo are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Changed
Confidentiality
Low
Integrity
Low
Availability
None
Affected Versions
marimo-team / marimo
0 < 0.23.9
References
github.com: https://github.com/marimo-team/marimo/releases/tag/0.23.9 github.com: https://github.com/marimo-team/marimo/pull/9789 github.com: https://github.com/marimo-team/marimo/commit/fdd55c8cf6260ae23bb411dc9d9269def5cf75d6 vulncheck.com: https://www.vulncheck.com/advisories/marimo-xss-via-file-query-parameter-in-assets-py
Credits
Elvin Suleymanov