marimo CVE-2026-75149

The victim must open an attacker-controlled or attacker-modified marimo notebook file in marimo's edit mode (as opposed to run mode or a read-only viewer). The notebook must contain a crafted MCP server configuration entry with a malicious command value. No authentication to any service is required from the attacker's side; the CVSS 4.0 vector confirms PR:N (no privileges). The vulnerability does not require any notebook cell to be executed - the subprocess is launched during notebook initialization. Exploitation is limited by the requirement for passive user interaction (UI:P): the victim must actively open the file in edit mode. Non-default configurations or special feature flags are not required beyond the MCP server entry being present in the notebook configuration block. The attack is local in execution impact (subprocess runs as the user running marimo) with no confirmed scope change to other systems (SC:N/SI:N/SA:N in the CVSS 4.0 vector).

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N) scores 8.7, reflecting near-automatic exploitation once a victim opens the file. The sole friction is UI:P (passive user interaction - opening a notebook), which meaningfully limits mass-exploitation scenarios but is a routine action for marimo's target audience of data scientists and developers. No CISA KEV listing is present and no POC code is referenced in the available intelligence, suggesting exploitation has not been observed at scale. The attack complexity is genuinely low: no authentication, no special configuration, and no exploit chain beyond file delivery. Real-world risk is highly dependent on notebook sharing workflows - organizations where users regularly open notebooks from external or untrusted sources (e.g., public GitHub repositories, email attachments, shared collaboration links) face elevated exposure. EPSS data was not provided; given the niche deployment footprint, broad automated scanning is unlikely.

An attacker publishes or sends a marimo notebook file (.py or .ipynb) that embeds a malicious MCP server configuration entry with an attacker-controlled command (e.g., a reverse shell or data exfiltration script). When a data scientist or developer opens the file in marimo's edit mode - a routine action - marimo's configuration handler reads the MCP entry and launches the embedded command as a local subprocess before displaying the notebook interface, granting the attacker immediate code execution on the victim's workstation. No public proof-of-concept code has been identified, but the attack is mechanically straightforward given the vulnerability description.