CVE-2026-54386: marimo Reflected XSS Vulnerability (CVSS 6.1)

Technical summary

The vulnerability is a reflected XSS flaw (CWE-79) in marimo's notebook page. The 'file' query parameter is reflected into inline JavaScript without proper escaping of single quotes, allowing an attacker to break out of a string literal and inject arbitrary code. The attack bypasses a 404 check by prefixing the payload with '__new__', and executes client-side without Content-Security-Policy restrictions in the victim's marimo origin. The flaw affects the client-side rendering layer rather than backend authentication or session management.

Business impact

An attacker leveraging this vulnerability could steal session tokens, read sensitive notebook contents, or perform unauthorized actions within a victim's marimo environment. If a marimo instance hosts confidential research, data analysis, or credentials, this XSS could lead to data exfiltration or unauthorized modifications. The attack requires social engineering (tricking a user into clicking a link), which limits broad exploitation; however, internal teams sharing marimo notebooks may be at elevated risk if links are distributed via email or messaging platforms. Organizations relying on marimo for collaborative or sensitive work should treat this as a priority remediation item.

Affected systems

All marimo installations running version 0.23.8 and earlier are vulnerable. marimo 0.23.9 and later versions contain the fix. The vulnerability is unauthenticated and client-side, so it affects any marimo server accessible to an attacker capable of crafting and distributing a malicious link to users who have active sessions.

Exploitability

Exploitability is moderate to high from a technical perspective: the attack requires no special tools or authentication, only the ability to craft a URL and social-engineer a user into clicking it. The barrier to exploitation is low for a skilled attacker; however, real-world impact depends on user behavior (users must click a link) and the sensitivity of the target environment. The lack of Content-Security-Policy protections increases the risk, as does the ability to bypass the 404 check using the '__new__' prefix technique.

Remediation

Upgrade marimo to version 0.23.9 or later. This version includes proper escaping of single quotes in the file query parameter, eliminating the injection vector. No workarounds are available for earlier versions; patching is the only reliable mitigation. If immediate patching is not possible, restrict access to marimo servers to trusted networks and educate users to avoid clicking suspicious links to marimo instances.

Patch guidance

Verify the installed version of marimo using 'pip show marimo' or similar package management tools. If the version is below 0.23.9, update immediately using 'pip install --upgrade marimo' or your organization's standard Python package update process. After upgrading, verify the fix by testing with a crafted XSS payload in the file parameter to confirm it no longer executes. Coordinate rollout across all internal marimo deployments to ensure consistency.

Detection guidance

Monitor web server logs for marimo instances for unusual query parameters in requests to the notebook page, particularly those containing JavaScript keywords, single quotes, or '__new__' prefixes in the 'file' parameter. Alert on any attempts to access non-existent files with payloads designed to break out of string literals. Additionally, review browser console logs and web security audit tools for instances of reflected XSS warnings or CSP violations. Intrusion detection systems should flag requests with common XSS payloads in query parameters.

Why prioritize this

Although the CVSS score is 6.1 (MEDIUM), this vulnerability merits prompt attention due to its low attack complexity, lack of authentication requirement, and potential for data exfiltration in collaborative environments. The user interaction requirement (clicking a link) reduces urgency compared to wormable flaws, but the ease of exploitation and ease of payload delivery via internal communication channels elevates practical risk. Organizations using marimo for sensitive work should prioritize this patch within their standard patching cycle.

Risk score, explained

The CVSS 3.1 score of 6.1 reflects a network-attack vector (AV:N), low attack complexity (AC:L), no privilege requirement (PR:N), required user interaction (UI:R), and changed scope (S:C) with low impact to confidentiality and integrity but no impact to availability. The score appropriately captures an unauthenticated XSS with cross-site implications and limited damage scope (low C and I impact), but does not account for the sensitivity of the data a particular marimo instance may contain. Organizations should adjust their internal risk assessment based on their use of marimo and the confidentiality of hosted notebooks.

Frequently asked questions