CVE-2026-75149

marimo before 0.23.15 contains a code injection vulnerability (CWE-94) in its notebook configuration handler. An attacker crafts a notebook whose embedded configuration includes an MCP server entry with an attacker-controlled command value; when a victim opens that notebook in edit mode, marimo launches the specified command as a local subprocess before any notebook cell runs, requiring no authentication and no cell execution. Successful exploitation gives the attacker arbitrary command execution on the victim's machine with the privileges of the marimo process, reflected in the high CVSS 4.0 score of 8.7 (network vector, user interaction required to open the notebook). Anyone running an affected marimo version who opens shared or untrusted notebook files in edit mode is affected. No public proof-of-concept, KEV listing, or known in-the-wild exploitation is currently reported, and EPSS estimates a 0.6% probability of exploitation in the next 30 days.

What to do: Upgrade marimo to 0.23.15 or later. Until patched, avoid opening notebooks from untrusted sources in edit mode (prefer read/preview mode), and inspect the notebook configuration—especially MCP server entries and their command fields—in shared notebooks before opening them.