Missing Authentication for Critical Function

Overview marimo is an A library for making reactive notebooks and apps Affected versions of this package are vulnerable to Missing Authentication for Critical Function via the terminal/ws WebSocket endpoint, which lacks authentication validation. An unauthenticated attacker can gain unauthorized...

Marimo: Pre-Auth Remote Code Execution via Terminal WebSocket Authentication Bypass

Summary Marimo 19.6k stars has a Pre-Auth RCE vulnerability. The terminal WebSocket endpoint /terminal/ws lacks authentication validation, allowing an unauthenticated attacker to obtain a full PTY shell and execute arbitrary system commands. Unlike other WebSocket endpoints e.g., /ws that correct...

Unauthenticated Network Exposure

marimo is vulnerable to unauthenticated network exposure. The vulnerability is due to the /mpl// endpoint being accessible without authentication, which allows an attacker to reach internal services and arbitrary ports...

GHSA-XJV7-6W92-42R7 marimo vulnerable to proxy abuse of /mpl/{port}/

Summary The /mpl// endpoint, which is accessible without authentication on default Marimo installations allows for external attackers to reach internal services and arbitrary ports. Details From our understanding, this route is used internally to provide access to interactive matplotlib...

marimo vulnerable to proxy abuse of /mpl/{port}/

Summary The /mpl// endpoint, which is accessible without authentication on default Marimo installations allows for external attackers to reach internal services and arbitrary ports. Details From our understanding, this route is used internally to provide access to interactive matplotlib...

Arbitrary Code Execution

Overview marimo is an A library for making reactive notebooks and apps Affected versions of this package are vulnerable to Arbitrary Code Execution due to the dynamic loading of notebooks as modules. An attacker can execute malicious code in notebooks during the loading process, potentially...

click-clack (>=0.1.0 <=0.2.1), paos (>=1.2.7 <=1.2.10) +1 more potentially affected by unknown CVE via marimo (>=0.10.19 <=0.11.31)

marimo PYPI version =0.10.19, =0.1.0, =1.2.7, =0.1.1.dev1736307293, =0.1.1.dev1742453945 Source cves: unknown CVE Source advisory: SNYK:PYTHON-MARIMO-12671196...

amazon-sagemaker-jupyter-scheduler (>=3.2.1 <=3.2.2), argo-jupyter-scheduler (>=0.0.1 <=2024.6.1rc1) +3 more potentially affected by CVE-2024-28188 via jupyter-scheduler (=2.12.0)

jupyter-scheduler PYPI version =2.12.0 is affected by a known vulnerability. The following packages have a transitive dependency on jupyter-scheduler and may be impacted: - amazon-sagemaker-jupyter-scheduler =3.2.1, =0.0.1, =0.1.0, =1.4.16, =1.2.0, =1.3.11 Source cves: CVE-2024-28188 Source...