Vulnerabilities for marimo

First version without a known vulnerability: 0.23.9

Details

• GHSA-8m59-7xv8-735h2026-06-18

  marimo contains a reflected cross-site scripting vulnerability in the notebook page

  Fixed in: 0.23.9

• GHSA-2679-6mx9-h9xc2026-04-08

  Marimo: Pre-Auth Remote Code Execution via Terminal WebSocket Authentication Bypass

  Fixed in: 0.23.0

• GHSA-xjv7-6w92-42r72025-10-01

  marimo vulnerable to proxy abuse of /mpl/{port}/

  Fixed in: 0.16.4