Vulnerability · Published Jun 17, 2026 · Assigned by VulnCheck
CVE-2026-54386marimo < 0.23.9 XSS via file Query Parameter in assets.py
Medium 6.1
In plain English
A medium-severity cross-site scripting in marimo from marimo-team. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 15% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
marimo before 0.23.9 contains a reflected cross-site scripting vulnerability in the notebook page that allows unauthenticated attackers to inject arbitrary JavaScript by exploiting improper escaping of single quotes in the file query parameter reflected into an inline JavaScript string literal. Attackers can craft a malicious link with a payload beginning with __new__ to bypass the 404 check and inject JavaScript into the page, which executes without Content-Security-Policy restrictions in the origin of a victim's marimo server.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| PyPI | marimo | 0.23.9 | GHSA-8m59-7xv8-735h |
| PyPI | marimo | 0.23.9 | PYSEC-2026-2619 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| marimo-team | marimo | 0 – before 0.23.9 |
Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
References
- https://github.com/marimo-team/marimo/releases/tag/0.23.9 release-notes
- https://github.com/marimo-team/marimo/pull/9789 issue-tracking
- https://github.com/marimo-team/marimo/commit/fdd55c8cf6260ae23bb411dc9d9269def5cf75d6 patch
- https://www.vulncheck.com/advisories/marimo-xss-via-file-query-parameter-in-assets-py third-party-advisory