Remote Code Injection Vulnerability in marimo

Marimo versions prior to 0.23.15 contain a critical command injection vulnerability within the notebook configuration handler. The vulnerability stems from how the platform processes Model Context Protocol (MCP) server entries stored within a notebook file. An attacker can supply a specially crafted MCP server entry containing an arbitrary command string. When a target user opens a notebook containing this malicious configuration in edit mode, the marimo application automatically triggers the execution of the embedded command as a local subprocess. This occurs before any notebook cells are processed and requires no authentication or manual execution of cell code, significantly lowering the barrier for exploitation. This vulnerability affects all platforms where marimo is deployed and requires immediate patching to version 0.23.15 or later.

Impact

Successful exploitation allows for arbitrary code execution in the context of the user running the marimo process. This can lead to full system compromise, data theft, or lateral movement within the victim's local environment. Because the exploit triggers upon opening the notebook, it poses a significant risk to developers and data scientists sharing notebook files.

Recommendation

• Upgrade marimo to version 0.23.15 or higher immediately.
• Audit existing notebook files for suspicious MCP server configurations or unexpected command-line entries.
• Restrict the opening of untrusted .marimo notebook files until all environments are patched.