AIKIDO-2026-201140

marimo is vulnerable to Code Injection

Pre-CVE Published Aug 7, 2026

CVE Score

Medium

Code Injection

TL;DR

marimo can resolve OpenGraph preview metadata for notebooks by executing a notebook-defined generator function referenced in PEP-723 script metadata. The server runs this generator automatically while resolving previews for index, file-listing, and thumbnail requests, so merely serving or listing a notebook executes its code without the notebook being run. A server that hosts or lists untrusted notebooks therefore runs arbitrary Python supplied by the notebook author. The fix makes generator execution opt-in behind an explicit flag that defaults to off.

How do I fix this?

Upgrade the marimo library to the patch version.

Who does this affect?

You are affected if you are using a version that falls within the vulnerable range and you serve or list untrusted notebooks that declare an OpenGraph generator, for example through a gallery or multi-notebook server.