CVE-2026-54386: marimo < 0.23.9 XSS via file Query Parameter in assets.py
marimo before 0.23.9 contains a reflected cross-site scripting vulnerability in the notebook page that allows unauthenticated attackers to inject arbitrary JavaScript by exploiting improper escaping of single quotes in the file query parameter reflected into an inline JavaScript string literal. Attackers can craft a malicious link with a payload beginning with new to bypass the 404 check and inject JavaScript into the page, which executes without Content-Security-Policy restrictions in the origin of a victim's marimo server.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
marimoto a version that resolves this vulnerability.Fixed in 0.23.9 - Compensating control
Apply Content-Security-Policy (CSP) to the marimo server pages to prevent injected scripts from executing without CSP restrictions.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-54386?
CVE-2026-54386 has a medium severity score of 6.1.
How do I fix CVE-2026-54386?
To fix CVE-2026-54386, upgrade to marimo version 0.23.9 or later.
What type of vulnerability is CVE-2026-54386?
CVE-2026-54386 is a reflected cross-site scripting (XSS) vulnerability.
What can attackers exploit in CVE-2026-54386?
Attackers can exploit CVE-2026-54386 by injecting arbitrary JavaScript through improper escaping of single quotes in the file query parameter.
Which software is affected by CVE-2026-54386?
CVE-2026-54386 affects the marimo software version below 0.23.9.