CVE-2026-67618 marimo-team CVE debrief

Who should care

Operators and users of marimo should assess exposure and verify configurations to prevent API key exfiltration. This includes reviewing notebook metadata for embedded malicious base_url, updating marimo to version 0.23.15 or later, and ensuring that configurations do not allow insufficient sanitization in sanitize_pyproject_dict. Additionally, they should confirm whether affected product deployments exist in managed environments and assign an owner for

Why it matters

The vulnerability allows notebook authors to exfiltrate operator API keys by embedding a malicious base_url in PEP-723 inline script metadata, which requires verification of marimo configurations and update to version 0.23.15 or later.

• API key exfiltration via malicious notebook metadata
• Configuration injection vulnerability in marimo
• Insufficient sanitization in sanitize_pyproject_dict

Technical summary

The vulnerability is caused by insufficient sanitization in sanitize_pyproject_dict, allowing notebook authors to embed a malicious base_url in PEP-723 inline script metadata. This malicious base_url is merged into session configuration with higher precedence than the operator's own settings, enabling the exfiltration of operator API keys when an AI request is made. To address this issue, it is crucial to verify marimo configurations, assess the exposure of operator API keys, and update marimo to version 0.23.15 or later.

Defensive priority

Operators and users of marimo should assess exposure and verify configurations.

Recommended defensive actions

• Verify marimo configurations for insufficient sanitization in sanitize_pyproject_dict.
• Assess exposure of operator API keys in notebook sessions.
• Update marimo to version 0.23.15 or later.
• Review notebook metadata for embedded malicious base_url.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The vulnerability allows notebook authors to exfiltrate operator API keys by embedding a malicious base_url in PEP-723 inline script metadata. This issue arises from insufficient sanitization in sanitize_pyproject_dict, which merges the malicious base_url into session configuration with higher precedence than the operator's own settings. To verify and mitigate this vulnerability, defenders should review marimo configurations, assess exposure of operator API keys in notebook sessions, and update marimo to version 0.23.15 or later. They

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.