AIKIDO-2026-201140

marimo is vulnerable to Code Injection

Code Injection Pre-CVE Published Aug 7, 2026

Medium Risk

This Affects:

marimo

0.19.8 - 0.23.14

Fixed in 0.23.15

Are you affected? Scan for Free

TL;DR

marimo can resolve OpenGraph preview metadata for notebooks by executing a notebook-defined generator function referenced in PEP-723 script metadata. The server runs this generator automatically while resolving previews for index, file-listing, and thumbnail requests, so merely serving or listing a notebook executes its code without the notebook being run. A server that hosts or lists untrusted notebooks therefore runs arbitrary Python supplied by the notebook author. The fix makes generator execution opt-in behind an explicit flag that defaults to off.

Who does this affect?

You are affected if you are using a version that falls within the vulnerable range and you serve or list untrusted notebooks that declare an OpenGraph generator, for example through a gallery or multi-notebook server.