{"answers":{"affected":"2 open source packages ship an affected version, including marimo.","exploited":"There is no known exploitation of GHSA-xjv7-6w92-42r7 in the wild and no public exploit code.","fix":"Upgrade marimo to 0.16.4 or later.","what":"GHSA-xjv7-6w92-42r7 is a server-side request forgery vulnerability in marimo, published on 1 Oct 2025. An attacker can exploit it over the internet without logging in, with no action from the victim."},"fix_prompt":"Check this codebase for GHSA-xjv7-6w92-42r7 and fix it if it is affected.\n\nWhat it is: GHSA-xjv7-6w92-42r7 is a server-side request forgery vulnerability in marimo, published on 1 Oct 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.\nExploitation: There is no known exploitation of GHSA-xjv7-6w92-42r7 in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- marimo (PyPI): affected from 0.9.20; fixed in 0.16.4\n- marimo (PyPI): affected from 0.9.20; fixed in 0.16.4\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/GHSA-xjv7-6w92-42r7/ (Markdown: https://insights.sbomify.com/GHSA-xjv7-6w92-42r7/index.md)","id":"GHSA-xjv7-6w92-42r7","markdown":"https://insights.sbomify.com/GHSA-xjv7-6w92-42r7/index.md","name":"GHSA-xjv7-6w92-42r7","record":{"aliases":[],"analysis":{"component_type":"server_software","fix_type":"patch","impacts":["data_read","code_execution"],"network_reachable":"yes","non_default_config":false,"product_category":"Python notebook server","requires_auth":"none","summary":"Unauthenticated proxy endpoint allows attackers to access internal local services, potentially leading to data exfiltration or remote code execution.","user_interaction":"not_required","vuln_class":"ssrf"},"analysis_generated_by":"qwen3.8-flash-next","assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"### Summary\nThe  `/mpl/\u003cport\u003e/\u003croute\u003e` endpoint, which is accessible without authentication on default Marimo installations allows for external attackers to reach internal services and arbitrary ports. \n\n### Details\nFrom our understanding, this route is used internally to provide access to interactive matplotlib visualizations.\n[marimo/marimo/_server/main.py at main · marimo-team/marimo](https://github.com/marimo-team/marimo/blob/main/marimo/_server/main.py) \nThis endpoint functions as an unauthenticated proxy, allowing an attacker to connect to any service running on the local machine via the specified `\u003cport\u003e` and `\u003croute\u003e`.\n\nThe existence of this proxy is visible in the application's code (marimo/_server/main.py), but there's no official documentation or warning about its behavior or potential risks.\n\n### Impact\nCWE-441: Proxying Without Authentication\n\nThis vulnerability, as it can be used to bypass firewalls and access internal services that are intended to be local-only. The level of impact depends entirely on what services are running and accessible on the local machine.\n\nFull Local Access: An attacker can use this proxy to connect to local services that answer to web sockets, HTTP or ASGI protocol, effectively gaining a foothold on the machine. Depending on the service, this can lead to remote code execution, data exfiltration, or further network penetration.\n\nExposure of Sensitive Services: Our scans of public-facing Marimo servers have shown that many are exposing sensitive internal services, including:\n\nOld CUPS Servers: Could allow an attacker to view print jobs or configuration or depending on old vulnerabilities, allow RCE.\n\nphpMyAdmin: Provides a web interface to a MySQL database, potentially exposing sensitive data.\n\nRPCMapper: Can be used for network reconnaissance and enumerating services.\n\nWhile you’d hope people wouldn’t expose marimo instances to the internet, we found numerous public Marimo instances using tools like Shodan. Many of these servers, some even hosted on cloud platforms like AWS GovCloud, were found to be vulnerable. This means the vulnerability isn't limited to a few isolated cases but is a widespread issue affecting production environments.\n\n===\n\nNotes, this was discovered by [devgi](https://github.com/devgi). I ([acepace](https://github.com/acepace)) followed up and also created this report.","ecosystems":["PyPI"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":true,"headline":"marimo vulnerable to proxy abuse of /mpl/{port}/","id":"GHSA-xjv7-6w92-42r7","indexable":true,"kev":null,"kind":"advisory","links":{"ecosystem":"PyPI","product":null,"products":[],"type":"ssrf","year":"2025"},"n_packages":2,"n_references":null,"packages":[{"ecosystem":"PyPI","fixed":["0.16.4"],"introduced":["0.9.20"],"last_affected":[],"package":"marimo","purl":null,"source":"GHSA-xjv7-6w92-42r7"},{"ecosystem":"PyPI","fixed":["0.16.4"],"introduced":["0.9.20"],"last_affected":[],"package":"marimo","purl":"pkg:pypi/marimo","source":"GHSA-xjv7-6w92-42r7"}],"products":null,"published":"2025-10-01","related":[],"sources":[{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":"Unauthenticated proxy endpoint allows attackers to access internal local services, potentially leading to data exfiltration or remote code execution.","url":"https://insights.sbomify.com/GHSA-xjv7-6w92-42r7/"}