GHSL-2026-226: TOCTOU in the Marimo test release workflow
Published Sep 16, 2026
·Updated
The marimo bot workflow uses one-second timestamps to reject pull request changes made after a maintainer authorizes a test release. An external contributor can exploit a same-second race to execute code and publish attacker-controlled packages to TestPyPI and npm.
Affected Software
2 affected components
npm/marimo-bot
pypi/marimo
Event History
Sep 16, 2026
Advisory Published
via GitHub Security Lab·12:00 AM
Data Sourced
via GitHub Security Lab·12:00 AM
Description
Frequently Asked Questions
1
Who is exposed to this issue?
Marimo projects using the `marimo bot` workflow to authorize test releases are exposed. The affected release targets identified are TestPyPI and npm.
2
What does an attacker need to exploit it?
An external contributor needs to make pull request changes in the same one-second timestamp window as a maintainer's test-release authorization. Successful exploitation can result in execution of code and publication of attacker-controlled packages to TestPyPI and npm.