Code Injection in marimo Notebooks Executes Commands via Crafted MCP Server Entries
AI analysis
marimo before 0.23.15 contains a code injection vulnerability (CWE-94) in its notebook configuration handler. An attacker crafts a notebook whose embedded configuration includes an MCP server entry with an attacker-controlled command value; when a victim opens that notebook in edit mode, marimo launches the specified command as a local subprocess before any notebook cell runs, requiring no authentication and no cell execution. Successful exploitation gives the attacker arbitrary command execution on the victim's machine with the privileges of the marimo process, reflected in the high CVSS 4.0 score of 8.7 (network vector, user interaction required to open the notebook). Anyone running an affected marimo version who opens shared or untrusted notebook files in edit mode is affected. No public proof-of-concept, KEV listing, or known in-the-wild exploitation is currently reported, and EPSS estimates a 0.6% probability of exploitation in the next 30 days.
What to do: Upgrade marimo to 0.23.15 or later. Until patched, avoid opening notebooks from untrusted sources in edit mode (prefer read/preview mode), and inspect the notebook configuration—especially MCP server entries and their command fields—in shared notebooks before opening them.
Affected
| marimo (open-source project) marimo | before 0.23.15 (fixed in 0.23.15) |
Estimated exposure
moderate≈ tens of thousands of users/installs (open-source Python notebook tool with modest adoption; only users opening untrusted notebooks in edit mode are exposed) — marimo is a newer, niche alternative to mainstream notebooks with an open-source user base plausibly in the tens of thousands, and actual exposure is limited to those who open attacker-supplied notebook files in edit mode rather than all…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
marimo before 0.23.15 contains a code injection vulnerability in the notebook configuration handler that allows attackers to execute arbitrary commands by supplying a crafted MCP server entry with an attacker-controlled command value embedded in a notebook. When the notebook is opened in edit mode, marimo launches the specified command as a local subprocess before any notebook cell is executed, requiring no authentication or cell execution to trigger the vulnerability.