# GHSA-xjv7-6w92-42r7: marimo vulnerable to proxy abuse of /mpl/{port}/

> Unauthenticated proxy endpoint allows attackers to access internal local services, potentially leading to data exfiltration or remote code execution.

- **Severity:** Not scored
- **Exploited in the wild:** Not known
- **Login needed:** Not needed
- **Attackable:** Over the internet
- **Victim action needed:** Not needed
- **Fix available:** Yes
- **Published:** 1 Oct 2025

## What is GHSA-xjv7-6w92-42r7?

GHSA-xjv7-6w92-42r7 is a server-side request forgery vulnerability in marimo, published on 1 Oct 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.

### Official description

### Summary
The  `/mpl/<port>/<route>` endpoint, which is accessible without authentication on default Marimo installations allows for external attackers to reach internal services and arbitrary ports. 

### Details
From our understanding, this route is used internally to provide access to interactive matplotlib visualizations.
[marimo/marimo/_server/main.py at main · marimo-team/marimo](https://github.com/marimo-team/marimo/blob/main/marimo/_server/main.py) 
This endpoint functions as an unauthenticated proxy, allowing an attacker to connect to any service running on the local machine via the specified `<port>` and `<route>`.

The existence of this proxy is visible in the application's code (marimo/_server/main.py), but there's no official documentation or warning about its behavior or potential risks.

### Impact
CWE-441: Proxying Without Authentication

This vulnerability, as it can be used to bypass firewalls and access internal services that are intended to be local-only. The level of impact depends entirely on what services are running and accessible on the local machine.

Full Local Access: An attacker can use this proxy to connect to local services that answer to web sockets, HTTP or ASGI protocol, effectively gaining a foothold on the machine. Depending on the service, this can lead to remote code execution, data exfiltration, or further network penetration.

Exposure of Sensitive Services: Our scans of public-facing Marimo servers have shown that many are exposing sensitive internal services, including:

Old CUPS Servers: Could allow an attacker to view print jobs or configuration or depending on old vulnerabilities, allow RCE.

phpMyAdmin: Provides a web interface to a MySQL database, potentially exposing sensitive data.

RPCMapper: Can be used for network reconnaissance and enumerating services.

While you’d hope people wouldn’t expose marimo instances to the internet, we found numerous public Marimo instances using tools like Shodan. Many of these servers, some even hosted on cloud platforms like AWS GovCloud, were found to be vulnerable. This means the vulnerability isn't limited to a few isolated cases but is a widespread issue affecting production environments.

===

Notes, this was discovered by [devgi](https://github.com/devgi). I ([acepace](https://github.com/acepace)) followed up and also created this report.

## Which versions are affected by GHSA-xjv7-6w92-42r7?

2 open source packages ship an affected version, including marimo.


| Package | Ecosystem | Affected | Fixed in |
| --- | --- | --- | --- |
| `marimo` | PyPI | From 0.9.20 | 0.16.4 |
| `marimo` | PyPI | From 0.9.20 | 0.16.4 |

## How do I fix GHSA-xjv7-6w92-42r7?

Upgrade marimo to 0.16.4 or later.

## Is GHSA-xjv7-6w92-42r7 being exploited?

There is no known exploitation of GHSA-xjv7-6w92-42r7 in the wild and no public exploit code.

## Fix prompt for AI coding agents

```text
Check this codebase for GHSA-xjv7-6w92-42r7 and fix it if it is affected.

What it is: GHSA-xjv7-6w92-42r7 is a server-side request forgery vulnerability in marimo, published on 1 Oct 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Exploitation: There is no known exploitation of GHSA-xjv7-6w92-42r7 in the wild and no public exploit code.

Affected packages and fixed versions:
- marimo (PyPI): affected from 0.9.20; fixed in 0.16.4
- marimo (PyPI): affected from 0.9.20; fixed in 0.16.4

Task:
1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.
2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.
3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.
4. Run the tests and summarise what changed and why.
5. If nothing in the project is affected, say so and change nothing.

Reference: https://insights.sbomify.com/GHSA-xjv7-6w92-42r7/ (Markdown: https://insights.sbomify.com/GHSA-xjv7-6w92-42r7/index.md)
```

## Sources

- OSV: https://osv.dev/vulnerability/GHSA-xjv7-6w92-42r7

---
From sbomify Insights: https://insights.sbomify.com/GHSA-xjv7-6w92-42r7/
Summaries are generated and may contain mistakes; the official description above is the record.