marimo

A library for making reactive notebooks and apps

Latest 0.25.2

PyPIApache-2.0

88%

Total Score

healthy

Frequent releases, strong project support, and complete packaging outweigh several GitHub Actions permission and secret-handling concerns.

Are you affected? Scan for Free

Health Score Breakdown

Workflow audit

All 30 workflows were analyzed without untrusted checkouts or script injection, and most use read-only permissions; however, several high-confidence findings involve inherited GitHub App permissions and secrets, while eight workflows grant top-level write access. Low-confidence cache poisoning and low-severity ad hoc package findings add minor hygiene concerns.

Vulnerabilities

Title	Versions	Severity
AIKIDO-2026-201140 Pre-CVE Found by Aikido Intel before public disclosure or CVE publication. marimo is vulnerable to Code Injection in versions 0.19.8 - 0.23.14.	0.19.8 - 0.23.14	Medium
AIKIDO-2026-835649 marimo is vulnerable to Exposure of Sensitive Information in versions 0.11.5 - 0.23.14.	0.11.5 - 0.23.14	Medium
CVE-2026-54386 marimo is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in versions 0.0.0 - 0.23.9.	0.0.0 - 0.23.9	Medium
CVE-2026-39987 marimo is vulnerable to Missing Authentication for Critical Function in versions 0.0.0 - 0.23.0.	0.0.0 - 0.23.0	Critical
AIKIDO-2025-10707 marimo is vulnerable to Unintended Proxy or Intermediary ('Confused Deputy') in versions 0.9.20 - 0.16.3.	0.9.20 - 0.16.3	Medium

Package versions

Version	Published	Vulnerabilities
0.25.2	19 Oct 2026	0 0 critical, 0 total 0 0 high, 0 total 0 0 medium, 0 total 0 0 low, 0 total
0.25.1	1 Oct 2026	0 0 critical, 0 total 0 0 high, 0 total 0 0 medium, 0 total 0 0 low, 0 total
0.25.0	23 Sept 2026	0 0 critical, 0 total 0 0 high, 0 total 0 0 medium, 0 total 0 0 low, 0 total
0.24.2	11 Sept 2026	0 0 critical, 0 total 0 0 high, 0 total 0 0 medium, 0 total 0 0 low, 0 total
0.24.1	10 Sept 2026	0 0 critical, 0 total 0 0 high, 0 total 0 0 medium, 0 total 0 0 low, 0 total
0.24.0	17 Aug 2026	0 0 critical, 0 total 0 0 high, 0 total 0 0 medium, 0 total 0 0 low, 0 total
0.23.16	31 Jul 2026	0 0 critical, 0 total 0 0 high, 0 total 0 0 medium, 0 total 0 0 low, 0 total
0.23.15	23 Jul 2026	0 0 critical, 0 total 0 0 high, 0 total 0 0 medium, 0 total 0 0 low, 0 total
0.23.14	10 Jul 2026	0 0 critical, 2 total 0 0 high, 2 total 2 2 medium, 2 total 0 0 low, 2 total
0.23.13	1 Jul 2026	0 0 critical, 2 total 0 0 high, 2 total 2 2 medium, 2 total 0 0 low, 2 total

Maintainers

No maintainer information available.

Direct Dependencies

Dependency	Last Release	Score
click Version <9,>=8.0; sys_platform != "emscripten"	—	—
jedi Version <0.21.0,>=0.18.0	—	—
markdown Version <4,>=3.6	—	—
pymdown-extensions Version <12,>=10.21.2	—	—
pygments Version <3,>=2.19	—	—