The vulnerability is a reflected cross‑site scripting flaw that occurs when the notebook page processes the "file" query parameter in assets.py. Improper escaping of single quotes allows an attacker to include arbitrary JavaScript in a string literal. By crafting a link that begins with __new__, the usual 404 check is bypassed, letting the malicious payload be reflected into the page. The injected code runs in the victim’s browser context, without any Content‑Security‑Policy restrictions applied by the server, exposing the user to session hijacking, credential theft, and other client‑side attacks.

Versions of the marimo application before 0.23.9 are affected. The vulnerability is present in the marimo‑team marimo product; any deployment running these older releases is potentially exposed.

With a CVSS score of 5.1 this issue is moderate in severity. The EPSS score of less than 1% indicates a very low likelihood of exploitation at this time, and the vulnerability is not listed in the CISA KEV catalog. Attackers would require no authentication to craft a malicious URL that targets an exposed notebook page in the victim’s marimo server, which is a typical user‑facing prompt or link shared with others.