Skip to main content

marimo CVE-2026-75149

| EUVDEUVD-2026-62665 HIGH
Code Injection (CWE-94)
2026-08-19 VulnCheck GHSA-gfgh-xp6v-q37q
Code Injection RCE Marimo
8.7
CVSS 4.0 · Vendor: VulnCheck
Share

Severity by source

Vendor (VulnCheck) PRIMARY
8.7 HIGH
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
8.8 HIGH

Attacker requires no privileges or auth; victim must open the notebook (UI:R); full C/I/A impact on local system with no scope change.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
P
Scope
X

Lifecycle Timeline

3
Source Code Evidence Fetched
Aug 19, 2026 - 18:28 vuln.today
Analysis Generated
Aug 19, 2026 - 18:28 vuln.today
CVE Published
Aug 19, 2026 - 17:48 cve.org
HIGH 8.7

DescriptionCVE.org

marimo before 0.23.15 contains a code injection vulnerability in the notebook configuration handler that allows attackers to execute arbitrary commands by supplying a crafted MCP server entry with an attacker-controlled command value embedded in a notebook. When the notebook is opened in edit mode, marimo launches the specified command as a local subprocess before any notebook cell is executed, requiring no authentication or cell execution to trigger the vulnerability.

AnalysisAI

Code injection in marimo before 0.23.15 allows an attacker who can deliver a crafted notebook file to execute arbitrary operating system commands on the victim's machine simply by having the victim open the notebook in edit mode. The vulnerability resides in the notebook configuration handler's MCP (Model Context Protocol) server entry processing: marimo reads attacker-controlled command values from the notebook's configuration and spawns them as local subprocesses before any notebook cell runs, giving the attacker immediate code execution with no further interaction required. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Craft notebook with malicious MCP server command
Delivery
Deliver notebook to target user
Exploit
Victim opens notebook in marimo edit mode
Execution
marimo configuration handler parses MCP entry
Persist
Malicious command launched as local subprocess
Impact
Arbitrary code executes as victim's OS user
Sign in to reveal

Vulnerability AssessmentAI

Exploitation The victim must open an attacker-controlled or attacker-modified marimo notebook file in marimo's edit mode (as opposed to run mode or a read-only viewer). … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N) scores 8.7, reflecting near-automatic exploitation once a victim opens the file. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker publishes or sends a marimo notebook file (.py or .ipynb) that embeds a malicious MCP server configuration entry with an attacker-controlled command (e.g., a reverse shell or data exfiltration script). When a data scientist or developer opens the file in marimo's edit mode - a routine action - marimo's configuration handler reads the MCP entry and launches the embedded command as a local subprocess before displaying the notebook interface, granting the attacker immediate code execution on the victim's workstation. …
Remediation Upgrade marimo to version 0.23.15 or later, which contains the fix introduced in PR #10281 (https://github.com/marimo-team/marimo/pull/10281) and committed at https://github.com/marimo-team/marimo/commit/1a21bd71e258438d2511136b5edacc94c08855f4. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours, identify all systems running marimo and disable external access to notebook files; notify users to avoid opening untrusted notebooks until patching is complete. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Marimo

View all
CVE-2026-67618 HIGH
7.1 Aug 04

Configuration injection in marimo before 0.23.15 enables a malicious notebook author to silently exfiltrate an operator'
CVE-2026-54386 MEDIUM
5.1 Jun 17

Reflected XSS in the marimo notebook server before version 0.23.9 enables unauthenticated remote attackers to inject and

Same weakness CWE-94 – Code Injection

View all
CVE-2023-3519 CRITICAL POC
9.8
CVE-2021-22205 CRITICAL POC
10.0
CVE-2012-0158 HIGH POC
8.8
CVE-2021-44529 CRITICAL POC
9.8
CVE-2014-6287 CRITICAL POC
9.8
CVE-2017-7494 CRITICAL POC
9.8
CVE-2013-3906 HIGH POC
7.8
CVE-2017-9822 HIGH POC
8.8

Same technique Code Injection

View all
CVE-2023-3519 CRITICAL POC
9.8
CVE-2021-22205 CRITICAL POC
10.0
CVE-2024-23692 CRITICAL POC
9.8
CVE-2012-0158 HIGH POC
8.8
CVE-2021-44529 CRITICAL POC
9.8
CVE-2014-6287 CRITICAL POC
9.8
CVE-2017-7494 CRITICAL POC
9.8
CVE-2025-24893 CRITICAL POC
9.8

Share

CVE-2026-75149 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy