Live › vulnerability › CVE-2026-39987
Go to dashboardMarimo (Python notebook) /terminal/ws WebSocket endpoint skips authentication, so an unauthenticated attacker gets a full PTY shell as the marimo process user. Exposure needs edit mode (not run/app mode) reachable over a network. Exploited in the wild within hours of disclosure; attackers stole .env secrets, cloud credentials and SSH keys.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:11 UTC, 5h before NVD. All times on this page are UTC.
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| Marimo Marimo | vendor | – | – |
| marimo | pypi | < 0.23.0 | 0.23.0 |
| coreweave marimo | vendor | < 0.23.0 | 0.23.0 |
pip show marimo (or marimo --version); anything below 0.23.0 is vulnerablemarimo edit) on the public internet or bound to --host 0.0.0.0 without your own authenticating proxy0.23.0 or later (pip install -U marimo>=0.23.0)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
marimo is a reactive Python notebook. Prior to 0.23.0, Marimo has a Pre-Auth RCE vulnerability. The terminal WebSocket endpoint /terminal/ws lacks authentication validation, allowing an unauthenticated attacker to obtain a full PTY shell and execute arbitrary system commands. Unlike other WebSocket endpoints (e.g., /ws) that correctly call validate_auth() for authentication, the /terminal/ws endpoint only checks the running mode and platform support before accepting connections, completely skipping authentication verification. This vulnerability is fixed in 0.23.0.
This page as .md · .json · in your agent: get_signal("CVE-2026-39987")
CISA KEV catalog, Creative Commons 0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.