marimo
A library for making reactive notebooks and apps
Declares an LLM dependency since 2024-03-06 (version 0.3.0).
Advisories
Advisories that name marimo as affected. Advisory records do not state an ecosystem, so packages with the same name in other ecosystems also match. For a version-exact check of your own dependencies, use Stack Check.
| Advisory | Severity | Affected | Fixed in | Published |
|---|---|---|---|---|
| CVE-2026-39987CVE-2026-39987: Marimo Remote Code Execution Vulnerability | Critical | < 0.23.0 | 0.23.0 | 2026-04-23 |
Dependencies of the latest release
As declared in PyPI metadata for version 0.25.1. Optional extras are listed with their extra name.
- mcp[mcp]Model Context Protocol SDK
- pydantic-ai-slim[recommended]Pydantic AI
- marimo-lens[recommended]reaches LLM
- altair[recommended]
- click
- cryptography[recommended]
- docutils
- duckdb[sql]
- httpx2[mcp]
- itsdangerous
- jedi
- loro
- markdown
- msgspec
- narwhals
- nbformat[recommended]
- opentelemetry-api[otel]
- opentelemetry-exporter-otlp-proto-grpc[otel]
- opentelemetry-exporter-otlp-proto-http[otel]
- opentelemetry-sdk[otel]
- packaging
- polars[sql]
- psutil
- pygments
- pymdown-extensions
- python-lsp-ruff[lsp]
- python-lsp-server[lsp]
- python-multipart
- pyyaml
- pyzmq
- ruff[recommended]
- sqlglot[sql]
- starlette
- tomlkit
- typing-extensions
- uv[sandbox]
- uvicorn
- websockets
Tracked packages that depend on it
Among the packages in the registry; not every dependent on PyPI.