---
id: CVE-2026-54386
title: >-
  marimo before 0.23.9 contains a reflected cross-site scripting vulnerability
  in the notebook page that allows unauthenticated attackers to inject arbitrary
  JavaScript by exploiting improper escaping of single quotes in the file query
  par…
summary: >-
  marimo before 0.23.9 contains a reflected cross-site scripting vulnerability
  in the notebook page that allows unauthenticated attackers to inject arbitrary
  JavaScript by exploiting improper escaping of single quotes in the file query
  par…
severity: medium
cvss: 6.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N'
cwe:
  - CWE-79
vendor: marimo-team
product: marimo
affected:
  - marimo < 0.23.9
patched:
  - marimo 0.23.9
published: '2026-06-17'
updated: '2026-10-08'
sourceUpdated: '2026-10-08T16:17:20.780'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-54386'
references:
  - url: >-
      https://github.com/marimo-team/marimo/commit/fdd55c8cf6260ae23bb411dc9d9269def5cf75d6
    label: disclosure@vulncheck.com
  - url: 'https://github.com/marimo-team/marimo/pull/9789'
    label: disclosure@vulncheck.com
  - url: 'https://github.com/marimo-team/marimo/releases/tag/0.23.9'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/marimo-xss-via-file-query-parameter-in-assets-py
    label: disclosure@vulncheck.com
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-54386'
  - url: 'https://github.com/advisories/GHSA-8m59-7xv8-735h'
tags:
  - nvd
  - cve.org
  - ghsa
  - pip
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-06-18T13:48:21.870654Z'
epss: 0.00239
epssPercentile: 0.14935
ecosystem: pip
ingestedAt: '2026-06-29T14:31:47.145Z'
---

## Overview

marimo before 0.23.9 contains a reflected cross-site scripting vulnerability in the notebook page that allows unauthenticated attackers to inject arbitrary JavaScript by exploiting improper escaping of single quotes in the file query parameter reflected into an inline JavaScript string literal. Attackers can craft a malicious link with a payload beginning with __new__ to bypass the 404 check and inject JavaScript into the page, which executes without Content-Security-Policy restrictions in the origin of a victim's marimo server.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-54386)

Affected packages:

- `marimo < 0.23.9`

Patched in:

- `marimo 0.23.9`

Source: https://github.com/advisories/GHSA-8m59-7xv8-735h