CVE-2026-67618 Details

A configuration injection vulnerability has been identified in Marimo versions prior to 0.23.15. This vulnerability allows notebook authors to exfiltrate operator API keys by embedding a malicious base_url in PEP-723 inline script metadata. The injected metadata is merged into the session configuration with higher precedence than the operator's own settings, due to insufficient sanitization in the 'sanitize_pyproject_dict' function. When an operator opens the crafted notebook and makes an AI request, Marimo retrieves the attacker-controlled base_url from the notebook configuration. It then falls back to the operator's OPENAI_API_KEY environment variable for authentication, inadvertently sending the API key to the attacker-controlled endpoint without requiring any cell execution.

Users can update to Marimo version 0.23.16 or later, where this vulnerability has been addressed.