---
id: "CVE-2026-39987"
kind: "vulnerability"
aliases: ["CVE-2026-39987"]
title: "coreweave marimo: marimo is a reactive Python notebook"
severity: "critical"
cvss: 9.8
epss: null
exploited: true
status: "open"
category: "ai-tooling"
products: [{"name": "Marimo Marimo", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "marimo", "fixed": ["0.23.0"], "affected": "< 0.23.0", "ecosystem": "pypi"}, {"name": "coreweave marimo", "fixed": ["0.23.0"], "affected": "< 0.23.0", "ecosystem": "vendor"}]
ecosystems: ["pypi", "vendor"]
tags: ["ai-tooling", "exploited", "marimo", "notebooks", "poc-public", "python", "self-hosted"]
not_affected_if: ["auth-required", "managed-hosting", "not-internet-exposed", "run-mode", "unknown", "wasm"]
published_at: "2026-04-09T18:17:02+00:00"
first_seen_at: "2026-10-23T19:11:51+00:00"
updated_at: "2026-10-24T07:16:04+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-39987", "first_seen_at": "2026-10-23T19:11:51+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T20:40:04+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39987", "first_seen_at": "2026-10-23T23:44:51+00:00"}, {"source": "github-poc", "url": "https://github.com/lunacysoft/CVE-2026-39987-POC-Marimo", "first_seen_at": "2026-10-24T06:17:56+00:00"}]
---

# coreweave marimo: marimo is a reactive Python notebook

Marimo (Python notebook) /terminal/ws WebSocket endpoint skips authentication, so an unauthenticated attacker gets a full PTY shell as the marimo process user. Exposure needs edit mode (not run/app mode) reachable over a network. Exploited in the wild within hours of disclosure; attackers stole .env secrets, cloud credentials and SSH keys.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Marimo Marimo affected ? fixed ?
- pypi:marimo affected < 0.23.0 fixed 0.23.0
- vendor:coreweave marimo affected < 0.23.0 fixed 0.23.0

## How to check

Run 'pip show marimo' (or 'marimo --version'); anything below 0.23.0 is vulnerable. Then check whether any instance runs in edit mode ('marimo edit') on the public internet or bound to --host 0.0.0.0 without your own authenticating proxy. Review access logs for connections to /terminal/ws from unknown IPs.

## Fix

Upgrade to marimo 0.23.0 or later (pip install -U 'marimo>=0.23.0'). Until then, don't expose edit-mode notebooks: bind to localhost, put an authenticating proxy in front, or run as an app (marimo run). If an exposed instance was reachable, rotate every secret in its environment/.env, cloud keys and SSH keys.

## Timeline

- 2026-10-23T19:11:51+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-39987
- 2026-10-23T20:40:04+00:00 analyst — Vendor advisory GHSA-2679-6mx9-h9xc and 0.23.0 release notes: all marimo < 0.23.0 affected, fixed in 0.23.0; Sysdig saw in-the-wild exploitation 9h41m after disclosure (credential theft); no public PoC at that time.
- 2026-10-23T23:44:51+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-39987
- 2026-10-24T06:17:56+00:00 github-poc https://github.com/lunacysoft/CVE-2026-39987-POC-Marimo

## Documents

- [advisory] GHSA-2679-6mx9-h9xc Marimo pre-auth RCE https://github.com/advisories/GHSA-2679-6mx9-h9xc
- [describes] Sysdig: Marimo RCE exploited in under 10 hours https://www.sysdig.com/blog/marimo-oss-python-notebook-rce-from-disclosure-to-exploitation-in-under-10-hours
- [fix] marimo 0.23.0 release notes https://github.com/marimo-team/marimo/releases/tag/0.23.0
- [poc] lunacysoft/CVE-2026-39987-POC-Marimo https://github.com/lunacysoft/CVE-2026-39987-POC-Marimo

## From the sources

marimo is a reactive Python notebook. Prior to 0.23.0, Marimo has a Pre-Auth RCE vulnerability. The terminal WebSocket endpoint /terminal/ws lacks authentication validation, allowing an unauthenticated attacker to obtain a full PTY shell and execute arbitrary system commands. Unlike other WebSocket endpoints (e.g., /ws) that correctly call validate_auth() for authentication, the /terminal/ws endpoint only checks the running mode and platform support before accepting connections, completely skipping authentication verification. This vulnerability is fixed in 0.23.0.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_