marimo vulnerabilities
CVEs whose affected-version data names the marimo package (pip). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
2 CVEsRSS
CVE-2026-54386Medium· 6.1marimo before 0.23.9 contains a reflected cross-site scripting vulnerability in the notebook page that allows unauthenticated attackers to inject arbitrary JavaScript by exploiting improper escaping of single quotes in the file query par…
marimo before 0.23.9 contains a reflected cross-site scripting vulnerability in the notebook page that allows unauthenticated attackers to inject arbitrary JavaScript by exploiting improper escaping of single quotes in the file query par…
▾ Sunlitmarimo-team · marimoEPSS 0.24%via NVD
GHSA-xjv7-6w92-42r7Mediummarimo vulnerable to proxy abuse of /mpl/{port}/
marimo vulnerable to proxy abuse of /mpl/{port}/
▾ Sunlitmarimo · marimovia OSV