Description

marimo before 0.23.15 contains a code injection vulnerability in the notebook configuration handler that allows attackers to execute arbitrary commands by supplying a crafted MCP server entry with an attacker-controlled command value embedded in a notebook. When the notebook is opened in edit mode, marimo launches the specified command as a local subprocess before any notebook cell is executed, requiring no authentication or cell execution to trigger the vulnerability.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-19T18:17:26.080Z",
  "pubdate": "2026-08-19T18:17:26.080Z",
  "executiveSummary": "A code injection vulnerability exists in marimo before 0.23.15, specifically within the notebook configuration handler. The vulnerability allows an unauthenticated attacker to achieve arbitrary command execution on a host system by embedding a maliciously crafted Model Context Protocol (MCP) server entry with an attacker-controlled command value inside a marimo notebook file.\nThe primary impact of this vulnerability is complete system compromise through arbitrary command execution. When a targeted user opens a malicious notebook in edit mode, the vulnerable application automatically spawns the attacker-specified command as a local subprocess. This execution occurs prior to the evaluation or execution of any individual notebook cells, bypassing standard interactive runtime safeguards.\nThe affected product is marimo in versions prior to 0.23.15. The risk implications are severe because successful exploitation requires no authentication, no user interaction beyond opening the file in edit mode, and no explicit execution of notebook code cells by the victim.\nAttackers require the ability to deliver a specially crafted notebook file to a target user and rely on the victim opening that file within the vulnerable marimo application environment.",
  "technicalDetails": "The vulnerability resides in the notebook configuration handler component of marimo, which processes configuration parameters defined within notebook files prior to runtime initialization. Specifically, the handling of MCP server entries fails to properly sanitize or validate command arguments supplied within the configuration metadata.\nThe root cause is insecure deserialization and direct invocation of unvalidated configuration strings as system processes. When marimo parses a notebook file containing an explicitly crafted Model Context Protocol (MCP) server entry, it extracts the attacker-controlled command value without enforcing strict allowlists or structural constraints on the executable path and its arguments.\nThe attack flow proceeds as follows: First, an attacker constructs a malicious marimo notebook containing a configuration block with a hostile MCP server entry. The command parameter within this entry is populated with arbitrary system commands or malicious payloads. Second, the victim opens the crafted notebook file within marimo in edit mode. Third, upon parsing the notebook configuration, the vulnerable handler initiates a local subprocess using the supplied attacker-controlled command string. Fourth, the operating system executes the spawned process under the security context of the user running the marimo application.\nThis exploitation vector requires no authentication, operates entirely locally upon file load, and mandates no privilege escalation beyond the standard permissions of the user running the application. Because the execution is triggered during the initialization phase of edit mode, it occurs automatically before any notebook cells can be inspected, reviewed, or executed by the user.\nThe affected component is the notebook configuration handler in marimo versions prior to 0.23.15. The post-exploitation impact includes arbitrary command execution, potential lateral movement, data exfiltration, and full compromise of the local environment depending on the privileges associated with the user session."
}