OSV

Related CVEsby mentions

• CVE-2026-399879.399%
  Unauthenticated Remote Code Execution in Marimo Python Notebook
  Marimo, a reactive Python notebook, contains an unauthenticated remote code execution flaw (CVE-2026-39987, CWE-306; CVSS 4.0: 9.3 Critical) because its terminal WebSocket endpoint /terminal/ws skips authentication entirely. Unlike other WebSocket endpoints such as /ws, which call validate_auth(), /terminal/ws only checks the running mode and platform support before accepting connections, so any unauthenticated attacker who can reach the server can obtain a full PTY shell and execute arbitrary system commands on the host. All marimo deployments running versions prior to 0.23.0 are affected, with internet-exposed instances at greatest risk. Exploitation is confirmed in the wild: the flaw was added to CISA's KEV catalog on 2026-04-23, public PoCs exist, and reporting shows it was exploited within roughly 10 hours of disclosure, with observed post-exploitation activity involving LLM agents. EPSS assigns a 98.9% probability of exploitation within 30 days (100th percentile).
  · Marimo (reactive Python notebook) all versions prior to 0.23.0 · CoreWeave marimo all versions prior to 0.23.0 KEV PoC ×4moderate
• CVE-2026-751498.7<1%
  Code Injection in marimo Notebooks Executes Commands via Crafted MCP Server Entries
  marimo before 0.23.15 contains a code injection vulnerability (CWE-94) in its notebook configuration handler. An attacker crafts a notebook whose embedded configuration includes an MCP server entry with an attacker-controlled command value; when a victim opens that notebook in edit mode, marimo launches the specified command as a local subprocess before any notebook cell runs, requiring no authentication and no cell execution. Successful exploitation gives the attacker arbitrary command execution on the victim's machine with the privileges of the marimo process, reflected in the high CVSS 4.0 score of 8.7 (network vector, user interaction required to open the notebook). Anyone running an affected marimo version who opens shared or untrusted notebook files in edit mode is affected. No public proof-of-concept, KEV listing, or known in-the-wild exploitation is currently reported, and EPSS estimates a 0.6% probability of exploitation in the next 30 days.
  · marimo (open-source project) marimo before 0.23.15 (fixed in 0.23.15)moderate
• CVE-2026-676187.1<1%
  marimo before 0.23.15 contains a configuration injection vulnerability that allows notebook authors to exfiltrate operator API keys by embedding a malicious bas
  marimo before 0.23.15 contains a configuration injection vulnerability that allows notebook authors to exfiltrate operator API keys by embedding a malicious base_url in PEP-723 inline script metadata, which is merged into session configuration with higher precedence than the operator's own settings due to insufficient sanitization in sanitize_pyproject_dict. When an operator opens the crafted notebook and makes an AI request, marimo resolves the attacker-controlled base_url from the notebook config while falling back to the operator's OPENAI_API_KEY environment variable for authentication,…
  —

Appears with