OSV

Mentions · 7d0
Mentions · 30d0
All mentions1
First seenAug 25, 2026
Last mentionedAug 25, 2026

Timeline

1 articles · newest first

Marimo Notebook Flaw Could Run MCP Commands Before Cells Execute in Edit Mode

Marimo notebook flaw CVE-2026-75149 (CVSS 8.7) allows attacker-supplied MCP commands to run as local subprocesses before any cell executes in edit mode.

The Hacker NewsAug 25, 12:43 UTC · Aug 25, 2026VulnerabilityCVE-2026-75149 CVE-2026-67618 CVE-2026-399871 · 1 read

Related CVEs

by mentions

CVE-2026-39987100%9.3
Unauthenticated Remote Code Execution in Marimo Python Notebook
published Apr 9, 2026Marimo (reactive Python notebook)KEVPoC ×8
CVE-2026-75149<1%8.7
Code Injection in marimo Notebooks Executes Commands via Crafted MCP Server Entries
published Aug 19, 2026marimo (open-source project) marimo
CVE-2026-67618<1%7.1
marimo before 0.23.15 contains a configuration injection vulnerability that allows notebook authors to exfiltrate operator API keys by embedding a malicious…
published Aug 4, 2026

Appears with

VulnCheckvendor · 1
Marimovendor · 1
PyPIorganization · 1
Marimo notebookproduct · 1

Entities are extracted by the model from each article. First seen Aug 25, 2026, last mentioned Aug 25, 2026. Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.