Marimo-team vulnerabilities
We track 2 vulnerabilities in Marimo-team products. 2 are rated high or critical, and 1 has been exploited in real attacks. The most recent was published on August 19, 2026.
2vulnerabilities
1critical
1high
1exploited
9.3average CVSS score
Latest Marimo-team vulnerabilities
- 8.8 High severity
marimo: Improper Control of Generation of Code
marimo before 0.23.15 contains a code injection vulnerability in the notebook configuration handler that allows attackers to execute arbitrary commands by supplying a crafted MCP server entry with an attacker-controlled command value embedded in a notebook. Wh
- 9.8 Critical severity
Marimo Remote Code Execution Exploited
marimo is a reactive Python notebook. Prior to 0.23.0, Marimo has a Pre-Auth RCE vulnerability. The terminal WebSocket endpoint /terminal/ws lacks authentication validation, allowing an unauthenticated attacker to obtain a full PTY shell and execute arbitrary