CVE-2026-67618: marimo Information Disclosure Vulnerability

CVE-2026-67618 Overview

CVE-2026-67618 is a configuration injection vulnerability in marimo versions before 0.23.15. Notebook authors can embed a malicious base_url in PEP-723 inline script metadata to exfiltrate operator API keys. The sanitize_pyproject_dict function fails to strip attacker-controlled values, allowing them to merge into session configuration with higher precedence than operator settings. When an operator opens the crafted notebook and issues an AI request, marimo resolves the attacker's base_url while falling back to the operator's OPENAI_API_KEY environment variable, transmitting the key to the attacker-controlled endpoint without any cell execution [CWE-345].

Critical Impact
Operators who open a malicious marimo notebook can leak their OPENAI_API_KEY to an attacker-controlled endpoint through a single AI request, requiring no code execution.

Affected Products

marimo versions before 0.23.15
Deployments exposing operator OPENAI_API_KEY environment variables
Notebooks using PEP-723 inline script metadata

Discovery Timeline

2026-08-04 - CVE-2026-67618 published to NVD
2026-08-04 - Last updated in NVD database

Technical Details for CVE-2026-67618

Vulnerability Analysis

The vulnerability originates in marimo's handling of PEP-723 inline script metadata within notebook files. PEP-723 permits Python scripts to declare dependencies and tool configuration inside a top-level comment block. marimo parses that block and merges it into its runtime configuration via sanitize_pyproject_dict in marimo/_config/reader.py. The sanitizer was designed to remove sensitive keys, but its traversal logic aborted early when intermediate keys were missing, leaving neighboring dangerous keys such as ai.open_ai.base_url intact. Because the notebook-supplied configuration merges with higher precedence than the operator's own settings, an attacker controls where marimo sends outbound AI requests. Authentication headers still include the operator's OPENAI_API_KEY, which marimo reads from the environment as a fallback. The result is silent credential exfiltration triggered by any subsequent AI feature use.

Root Cause

The root cause is insufficient input validation of untrusted configuration data (CWE-345, Insufficient Verification of Data Authenticity). The original sanitize_pyproject_dict returned early upon encountering a missing intermediate key, halting sanitization of the remaining keys in its blocklist. Trust boundaries between notebook-supplied metadata and operator-controlled configuration were not enforced.

Attack Vector

An attacker crafts a marimo notebook containing PEP-723 metadata that sets tool.marimo.ai.open_ai.base_url to an attacker-controlled URL. The attacker distributes the notebook through a repository, chat, or email. When an operator opens the notebook and triggers any AI feature, marimo issues an outbound request to the attacker's endpoint carrying the operator's OPENAI_API_KEY from the environment.

python

# Security patch in marimo/_config/reader.py - additional PEP 723 sanitization (#10281)
    """Sanitize the pyproject.toml dictionary by removing specified keys."""
    for key_path in keys:
        current_level = pyproject_dict
        missing_intermediate = False
        for key in key_path[:-1]:
            if key in current_level and isinstance(current_level[key], dict):
                current_level = current_level[key]
            else:
                missing_intermediate = True
                break
        if missing_intermediate:
            continue
        if current_level and key_path[-1] in current_level:
            LOGGER.warning(
                "%s in script metadata is ignored for security reasons",

Source: GitHub Commit 1a21bd7. The patch replaces the early return with continue, ensuring every blocked key path is evaluated. A companion change in marimo/_config/manager.py introduces ALLOWED_SCRIPT_CONFIG_TOP_KEYS and allowlist_script_config, moving the sanitizer from a blocklist to an allowlist model.

Detection Methods for CVE-2026-67618

Indicators of Compromise

Outbound HTTPS requests from marimo hosts to non-standard OpenAI-compatible endpoints, especially domains that do not match api.openai.com or approved provider hosts.
PEP-723 metadata blocks in notebook files that set keys under tool.marimo.ai.open_ai.base_url or override AI provider configuration.
Notebook files fetched from untrusted sources shortly before an unexpected AI request is observed.

Detection Strategies

Scan notebook repositories for PEP-723 script metadata that references tool.marimo AI configuration keys.
Alert on marimo processes making egress connections to hosts outside an allowlist of approved AI providers.
Compare marimo version strings in inventory data against 0.23.15 to identify unpatched installs.

Monitoring Recommendations

Log and review all outbound requests carrying Authorization: Bearer headers from developer workstations running marimo.
Rotate OPENAI_API_KEY values on any host that opened a notebook from an untrusted source before applying the patch.
Track process-to-network mappings so that marimo network activity can be attributed to specific opened notebooks.

How to Mitigate CVE-2026-67618

Immediate Actions Required

Upgrade marimo to version 0.23.15 or later on every operator workstation and server.
Rotate OPENAI_API_KEY and any other AI provider credentials that were reachable from marimo processes.
Audit recently opened notebooks for PEP-723 metadata blocks setting base_url or other AI configuration keys.

Patch Information

The fix ships in marimo release 0.23.15 via pull request #10281. The patch corrects the sanitizer traversal in marimo/_config/reader.py and introduces an allowlist of permitted script-config top keys in marimo/_config/manager.py. Full technical background is available in the VulnCheck Security Advisory.

Workarounds

Do not open marimo notebooks from untrusted sources until the upgrade is applied.
Remove OPENAI_API_KEY from the environment of marimo processes that need to open untrusted notebooks, and pass credentials only through short-lived, scoped mechanisms.
Enforce egress network policies that restrict marimo hosts to a fixed allowlist of AI provider endpoints.

bash

# Upgrade marimo and verify the installed version
pip install --upgrade 'marimo>=0.23.15'
python -c "import marimo; print(marimo.__version__)"

# Optionally unset the operator API key before opening untrusted notebooks
unset OPENAI_API_KEY