CVE-2026-54386: falha de média gravidade em marimo-team marimo
marimo < 0.23.9 XSS via file Query Parameter in assets.py
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 5.1epss 0.2%
marimo before 0.23.9 contains a reflected cross-site scripting vulnerability in the notebook page that allows unauthenticated attackers to inject arbitrary JavaScript by exploiting improper escaping of single quotes in the file query parameter reflected into an inline JavaScript string literal. Attackers can craft a malicious link with a payload beginning with __new__ to bypass the 404 check and inject JavaScript into the page, which executes without Content-Security-Policy restrictions in the origin of a victim's marimo server.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
Produtos afetados
marimo-team · marimoCVEs relacionadas — marimo-team marimo
No mesmo produto, das mais perigosas para as menos.
CVE-2026-39987CRITICALmarimo Affected by Pre-Auth Remote Code Execution via Terminal WebSocket Authentication BypassEPSS 99.7%KEVCVE-2026-75149HIGHmarimo < 0.23.15 Code Injection via MCP Server ConfigurationEPSS 1.0%CVE-2026-67618HIGHmarimo < 0.23.15 API Key Exfiltration via Malicious Notebook PEP-723 MetadataEPSS 0.3%