Marimo Notebook Flaw Could Run MCP Commands Before Cells Execute in Edit Mode

Marimo, a reactive Python notebook, contains an unauthenticated remote code execution flaw (CVE-2026-39987, CWE-306; CVSS 4.0: 9.3 Critical) because its terminal WebSocket endpoint /terminal/ws skips authentication entirely. Unlike other WebSocket endpoints such as /ws, which call validate_auth(), /terminal/ws only checks the running mode and platform support before accepting connections, so any unauthenticated attacker who can reach the server can obtain a full PTY shell and execute arbitrary system commands on the host. All marimo deployments running versions prior to 0.23.0 are affected, with internet-exposed instances at greatest risk. Exploitation is confirmed in the wild: the flaw was added to CISA's KEV catalog on 2026-04-23, public PoCs exist, and reporting shows it was exploited within roughly 10 hours of disclosure, with observed post-exploitation activity involving LLM agents. EPSS assigns a 98.9% probability of exploitation within 30 days (100th percentile).

Do: Upgrade marimo to 0.23.0 or later; until patched, restrict access to the /terminal/ws WebSocket endpoint by binding the notebook to localhost, a VPN, or an authenticating reverse proxy. Identify whether any marimo instances are internet-exposed and review logs for connections to /terminal/ws and unexpected shell or process spawns, given reports of LLM-agent-driven post-exploitation on compromised instances. As a KEV entry (added 2026-04-23), this requires federal agencies to apply the vendor fix or mitigations per BOD 22-01 timelines.

marimo before 0.23.15 contains a configuration injection vulnerability that allows notebook authors to exfiltrate operator API keys by embedding a malicious base_url in PEP-723 inline script metadata, which is merged into session configuration with higher precedence than the operator's own settings due to insufficient sanitization in sanitize_pyproject_dict. When an operator opens the crafted notebook and makes an AI request, marimo resolves the attacker-controlled base_url from the notebook config while falling back to the operator's OPENAI_API_KEY environment variable for authentication, transmitting the API key to the attacker-controlled endpoint without requiring any cell execution.

marimo before 0.23.15 contains a code injection vulnerability (CWE-94) in its notebook configuration handler. An attacker crafts a notebook whose embedded configuration includes an MCP server entry with an attacker-controlled command value; when a victim opens that notebook in edit mode, marimo launches the specified command as a local subprocess before any notebook cell runs, requiring no authentication and no cell execution. Successful exploitation gives the attacker arbitrary command execution on the victim's machine with the privileges of the marimo process, reflected in the high CVSS 4.0 score of 8.7 (network vector, user interaction required to open the notebook). Anyone running an affected marimo version who opens shared or untrusted notebook files in edit mode is affected. No public proof-of-concept, KEV listing, or known in-the-wild exploitation is currently reported, and EPSS estimates a 0.6% probability of exploitation in the next 30 days.

Do: Upgrade marimo to 0.23.15 or later. Until patched, avoid opening notebooks from untrusted sources in edit mode (prefer read/preview mode), and inspect the notebook configuration—especially MCP server entries and their command fields—in shared notebooks before opening them.