Marimo Notebook Flaw Could Run MCP Commands Before Cells Execute in Edit Mode
Marimo notebook flaw CVE-2026-75149 (CVSS 8.7) allows attacker-supplied MCP commands to run as local subprocesses before any cell executes in edit mode.
Marimo addressed CVE-2026-75149, a high-severity code injection flaw allowing attacker-supplied Model Context Protocol (MCP) commands to execute as local subprocesses when a crafted notebook is opened in edit mode, before any cell runs. The issue affects versions prior to 0.23.15, carries CVSS v4 of 8.7 and CVSS v3.1 of 8.8, and requires user interaction but no authentication. Marimo fixed it in version 0.23.15 (released July 23, 2026) via a PEP 723 hardening patch that treats notebook metadata as attacker-controlled and strips ai, mcp, completion, secrets, and server configuration sections. VulnCheck's CNA also disclosed CVE-2026-67618 (CVSS 7.1), involving an attacker-controlled AI base_url that exfiltrates operator API keys, and earlier CVE-2023-39987, a missing auth on /terminal/ws endpoint allowing full PTY shell access.
- CVE-2026-75149 allows attacker MCP commands to execute before any notebook cell runs
- Fixed in Marimo 0.23.15 via PEP 723 hardening patch stripping notebook metadata sections
- CVSS v4 8.7 / v3.1 8.8; user interaction required, no auth needed
- Related CVE-2026-67618 (CVSS 7.1) leaks API keys via attacker-controlled AI base_url
- Discovered by Gregory Tan (Grg0rry); current PyPI release is 0.24.0
- Products
- Marimo notebook
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-39987 | Unauthenticated Remote Code Execution in Marimo Python Notebook | 9.3 | 100% | KEVPoC ×8 | KEV |
| CVE-2026-67618 | marimo before 0.23.15 contains a configuration injection vulnerability that allows notebook authors to exfiltrate operator API keys by embedding a malicious… | 7.1 | <1% | ||
| CVE-2026-75149 | Code Injection in marimo Notebooks Executes Commands via Crafted MCP Server Entries | 8.7 | <1% |
From the original article
2 min read at thehackernews.com
Swati Khandelwal Aug 25, 2026 Vulnerability / AI Security Marimo has addressed a high-severity security flaw in its notebook software that allowed an attacker to execute an attacker-supplied Model Context Protocol (MCP) command in a specially crafted notebook, according to VulnCheck's CVE Numbering Authority (CNA) record.
By @TheHackersNews · thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.