Configuration Injection Vulnerability in Marimo by Marimo Team

CVE-2026-67618

What is CVE-2026-67618?

Marimo versions before 0.23.15 are susceptible to a configuration injection vulnerability that enables attackers to exfiltrate operator API keys. This occurs when notebook authors embed a malicious base_url in PEP-723 inline script metadata. Due to improper sanitization in the 'sanitize_pyproject_dict' function, this malicious configuration has higher precedence than the operator's original settings. When an operator opens a compromised notebook and initiates an AI request, the malware resolves the attacker-controlled base_url while utilizing the operator's OPENAI_API_KEY environment variable for authentication. This process results in the sensitive API key being transmitted to the attacker-controlled endpoint without requiring any execution of notebook cells.

References