CVE-2026-54386 Details
Description
marimo before 0.23.9 contains a reflected cross-site scripting vulnerability in the notebook page that allows unauthenticated attackers to inject arbitrary JavaScript by exploiting improper escaping of single quotes in the file query parameter reflected into an inline JavaScript string literal. Attackers can craft a malicious link with a payload beginning with __new__ to bypass the 404 check and inject JavaScript into the page, which executes without Content-Security-Policy restrictions in the origin of a victim's marimo server.
A reflected cross-site scripting vulnerability has been identified in Marimo versions prior to 0.23.9. This issue allows unauthenticated attackers to inject arbitrary JavaScript into the notebook page. The vulnerability arises from improper escaping of single quotes in the file query parameter, which is reflected into an inline JavaScript string literal. Attackers can craft a malicious link with a payload starting with '__new__' to bypass the 404 check and inject JavaScript that executes without Content-Security-Policy restrictions on the victim's Marimo server.
Users can update to Marimo version 0.23.9 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jun 17, 2026CISA-ADP
Assessed Jun 18, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/marimo-team/marimo/commit/fdd55c8cf6260ae23bb411dc9d9269def5cf75d6 | [email protected] | Source CodeVendor |
| https://github.com/marimo-team/marimo/pull/9789 | [email protected] | Issue TrackingVendor |
| https://github.com/marimo-team/marimo/releases/tag/0.23.9 | [email protected] | Release NotesVendor |
| https://www.vulncheck.com/advisories/marimo-xss-via-file-query-parameter-in-assets-py | [email protected] | AdvisoryRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| marimo | < 0.23.9 (semver) |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 14, 2026 | CVE Modified | [email protected] |
| Jun 18, 2026 | CVE Modified | CISA-ADP |
| Jun 17, 2026 | New CVE Received | [email protected] |