CVE-2026-67618: marimo < 0.23.15 API Key Exfiltration via Malicious Notebook PEP-723 Metadata

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-08-04 · updated 2026-10-23
Weakness: CWE-345

Description

marimo before 0.23.15 contains a configuration injection vulnerability that allows notebook authors to exfiltrate operator API keys by embedding a malicious base_url in PEP-723 inline script metadata, which is merged into session configuration with higher precedence than the operator's own settings due to insufficient sanitization in sanitize_pyproject_dict. When an operator opens the crafted notebook and makes an AI request, marimo resolves the attacker-controlled base_url from the notebook config while falling back to the operator's OPENAI_API_KEY environment variable for authentication, transmitting the API key to the attacker-controlled endpoint without requiring any cell execution.

Affected products

marimo-team marimo: before 0.23.15 — fixed in 0.23.15

How to fix

Upgrade to a fixed version: marimo-team marimo 0.23.15. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-67618 or the next vulnerability affects your stack