marimo < 0.23.9 XSS via file Query Parameter in assets.py

An unauthenticated attacker crafts a malicious link containing a `file` query parameter that starts with `__new__` (to bypass the 404 check) and includes a single-quote-termination payload such as `'-alert(document.domain)-'`. When a victim visits this link, the server reflects the payload into an inline `<script>` block as `const notebookId = '__new__'-alert(document.domain)-'';`, breaking out of the string literal and executing arbitrary JavaScript in the origin of the marimo server. No Content-Security-Policy restrictions apply because the script is inline and same-origin. [ref_id=1]

The vulnerability is in `marimo/_server/api/endpoints/assets.py` in the `_inject_service_worker` function. The `file_key` parameter, which is user-controlled via the `file` query parameter, was interpolated directly into a JavaScript string literal using single quotes without escaping. The patch changes the interpolation to use `json_script()` which emits a double-quoted JSON string literal, preventing injection.

The patch replaces the single-quoted string interpolation `'{uri_encode_component(file_key)}'` with `{json_script(uri_encode_component(file_key))}`. The `json_script()` helper emits the value as a properly escaped JSON string literal using double quotes, so any embedded single quotes or `</script>` sequences are neutralized. The test `test_inject_service_worker_escapes_file_key` confirms that a payload containing single quotes no longer breaks out of the string literal and that `</script>` sequences are also sanitized. [patch_id=6466808]