marimo before 0.23.15 contains a code injection flaw in the notebook configuration handler that allows an attacker to run arbitrary system commands by embedding a crafted MCP server entry within a notebook. When the notebook is opened in edit mode, marimo spawns the specified command as a local subprocess before any notebook cell is executed, and the vulnerability is triggered without requiring authentication or any cell execution. The flaw effectively grants an attacker the power to execute commands with the privileges of the user running marimo.

The affected product is marimo‑team’s marimo software, versions earlier than 0.23.15. The release tagged 0.23.15 includes the fix for this issue.

The CVSS score of 8.7 indicates a high severity. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog. Because the flaw can be triggered by simply opening a notebook file in edit mode, an attacker who can supply a malicious notebook file—such as through a shared repository or compromised storage—can execute arbitrary commands on the host system. No network access or authentication is required, which raises the risk of local exploitation for users who grant marimo access to untrusted notebooks.