Reflected Cross-Site Scripting Vulnerability in Marimo by Marimo Team

CVE-2026-54386

What is CVE-2026-54386?

The Marimo product prior to version 0.23.9 is susceptible to a reflected cross-site scripting vulnerability located in the notebook page. This flaw allows unauthenticated attackers to inject arbitrary JavaScript code by exploiting improper escaping of single quotes within the file query parameter. By creating a specifically crafted malicious link, an attacker can execute JavaScript on the victim's server without being obstructed by Content-Security-Policy (CSP) measures. This vulnerability poses significant risks, as it enables attackers to execute malicious scripts in the context of a user's session.

References