Provenance Record

Well-structured News piece (Overview / What We Know / What We Don't Know / Response and Remediation) at 723 words, within the 400-1200 range for the News category. Technical explanation of the notebook-metadata precedence bug and the fix's allowlist approach is clear and accurate.

All 6 sources fetched successfully (manifest.json, no null files, no suspicious_patterns). Read every snapshot from disk after gunzip: source-0.html.gz (NVD CVE-2026-75149) confirms CVE ID, description text verbatim, CVSS v4.0 8.7 HIGH, CVSS v3.1 8.8 HIGH, CWE-94, published 08/19/2026, affected versions <0.23.15. source-1.html.gz (NVD CVE-2026-67618) confirms CVE ID, CVSS v4.0 7.1 HIGH, published 08/04/2026, description text (one quoted fragment in the article drops the word 'to' from the source description -- see finding). source-2.html.gz (GHSA-gfgh-xp6v-q37q) confirms the GHSA ID, identical description text to NVD, CVSS 8.7, CWE-94, published Aug 19 2026. source-3.html.gz (fix commit 1a21bd7) confirms PR #10281 'fix: additional pep 723 sanitization', authors dmadisetti (displayName 'Dylan Madisetti' per embedded JSON) and Grg0rry as co-author, commit authored/committed 2026-07-23, code comment text quoted in the article matches verbatim, and the ALLOWED_SCRIPT_CONFIG_TOP_KEYS allowlist confirms formatting/display/keymap/package_management remain settable while ai/mcp/completion/secrets/server are excluded. source-4.html.gz (release 0.23.15) confirms the release was published 2026-07-23T19:21:02Z, same date as the fix commit, corroborating that the fix shipped in that release despite PR #10281 not appearing in the release's categorized changelog list (a plausible silent-patch pattern for a security fix). source-5.html.gz (The Hacker News) independently corroborates CVE-2026-75149's CVSS scores, CVE-2026-67618's CVSS 7.1 and Aug 4 disclosure date, the Gregory Tan / Grg0rry researcher credit, the 0.23.15 release date, and the CVE-2026-39987 (April 2026, /terminal/ws, fixed in 0.23.0) distinction. No source required a WebFetch fallback -- all snapshots loaded cleanly.

Headline and lead-critical facts -- CVE-2026-75149 identifier, CVSS v4.0 8.7 / v3.1 8.8 scores, GHSA-gfgh-xp6v-q37q advisory ID, fixed-in-0.23.15 claim -- all verified byte-for-byte against NVD and GitHub Security Advisory snapshots. One quote-fidelity issue found in the body: the fragment 'notebook authors exfiltrate operator API keys by embedding a malicious base_url in PEP-723 inline script metadata' inside quotation marks omits the word 'to' present in NVD's actual CVE-2026-67618 description ('...allows notebook authors to exfiltrate...'). The claim's substance and the second quoted fragment ('with higher precedence than the operator's own settings') are exact. No other quote in the body (NVD CVE-2026-75149 description, the commit's ALLOWED_SCRIPT_CONFIG_TOP_KEYS code-comment quote) deviates from source text. The characterization of Dylan Madisetti as a 'marimo maintainer' is a reasonable inference from his authorship of the security-hardening commit and inclusion in the release's contributor list, but is not a title explicitly stated in any source -- noted here as a minor unsourced characterization, not rising to the level of a formal correction.

Strong, well-sourced submission on a genuinely new, correctly cross-referenced CVE. The CVE identifier, both CVSS scores, the GHSA ID, and the fixed-version claim all check out exactly against NVD and GitHub. Only one minor, non-headline quote-fidelity slip was found, which is fully and honestly coverable by a public corrections note. Approved with corrections.