The vulnerability resides in marimo versions prior to 0.23.15. It permits a notebook author to embed a malicious base_url within the PEP‑723 inline script metadata. Because the sanitize_pyproject_dict function fails to properly sanitize this field, the attacker-controlled value is applied with higher priority than the operator's own configuration. When an operator opens the notebook and initiates an AI request, marimo resolves the base_url from the notebook, falls back to the operator's OPENAI_API_KEY environment variable for authentication, and inadvertently transmits that key to the attacker‑controlled endpoint. As a result, the operator’s API key is exfiltrated without requiring any cell execution or additional interaction, exposing the operator to full credential compromise.

The impacted product is marimo produced by the marimo‑team. All releases earlier than 0.23.15 are affected.

The CVSS score of 7.1 indicates high severity. EPSS information is not available, but the attack is straightforward: an operator must merely open a malicious notebook file, which does not require execution of code. The vulnerability is not listed in the CISA KEV catalog. Consequently, the exploitation likelihood is significant in environments where untrusted notebooks can be opened or where social engineering could lead operators to open such notebooks.