What’s Vulnerable › Vulnerabilities

CVE-2026-54386: marimo < 0.23.9 XSS via file Query Parameter in assets.py

• Severity: medium (CVSS 6.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-06-17 · updated 2026-10-26
• Weakness: CWE-79

Description

marimo before 0.23.9 contains a reflected cross-site scripting vulnerability in the notebook page that allows unauthenticated attackers to inject arbitrary JavaScript by exploiting improper escaping of single quotes in the file query parameter reflected into an inline JavaScript string literal. Attackers can craft a malicious link with a payload beginning with __new__ to bypass the 404 check and inject JavaScript into the page, which executes without Content-Security-Policy restrictions in the origin of a victim's marimo server.

Affected products

• marimo-team marimo: before 0.23.9 — fixed in 0.23.9

How to fix

Upgrade to a fixed version: marimo-team marimo 0.23.9. Check the vendor advisory for mitigations.

References

• https://github.com/marimo-team/marimo/commit/fdd55c8cf6260ae23bb411dc9d9269def5cf75d6
• https://github.com/marimo-team/marimo/pull/9789
• https://github.com/marimo-team/marimo/releases/tag/0.23.9
• https://www.vulncheck.com/advisories/marimo-xss-via-file-query-parameter-in-assets-py

Get alerted when CVE-2026-54386 or the next vulnerability affects your stack