CVE-2026-67618: marimo < 0.23.15 API Key Exfiltration via Malicious Notebook PEP-723 Metadata

marimo before 0.23.15 contains a configuration injection vulnerability that allows notebook authors to exfiltrate operator API keys by embedding a malicious baseurl in PEP-723 inline script metadata, which is merged into session configuration with higher precedence than the operator's own settings due to insufficient sanitization in sanitizepyprojectdict. When an operator opens the crafted notebook and makes an AI request, marimo resolves the attacker-controlled baseurl from the notebook config while falling back to the operator's OPENAIAPIKEY environment variable for authentication, transmitting the API key to the attacker-controlled endpoint without requiring any cell execution.