CVE-2026-39987

KEV catalog · CISA Known Exploited Vulnerabilities

CVE-2026-39987 9.8

Marimo · Marimo · Added 2026-04-23 · Published 2026-04-09

3-Day Required PoC Available KEV Automatable Active Exploitation

Details

VulnerabilityMarimo Remote Code Execution Vulnerability

VendorMarimo

ProductMarimo

Date added2026-04-23

Due date2026-05-07

CISA catalogView on CISA KEV catalog

Required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

CWECWE-306

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Descriptions

KEV: Marimo contains an pre-authorization remote code execution vulnerability, allowing an unauthenticated attacked to shell access and execute arbitrary system commands.

NVD: marimo is a reactive Python notebook. Prior to 0.23.0, Marimo has a Pre-Auth RCE vulnerability. The terminal WebSocket endpoint /terminal/ws lacks authentication validation, allowing an unauthenticated attacker to obtain a full PTY shell and execute arbitrary system commands. Unlike other WebSocket endpoints (e.g., /ws) that correctly call validate_auth() for authentication, the /terminal/ws endpoint only checks the running mode and platform support before accepting connections, completely skipping authentication verification. This vulnerability is fixed in 0.23.0.

Compliance SSVC + BOD 26-04

Automatableyes

Technical impacttotal

Exploitation statusactive

3-day qualifyingYes

Public timeline3 days + forensic

Non-public timeline3 days + forensic

Forensic (public)Required

Forensic (non-public)Required

Research metadata

Last researched2026-06-12 13:50 UTC

Wall time30.0s

Searches6

Component defaultyes

Hunting hypothesis agent

Monitor for unauthenticated WebSocket connections to the /terminal/ws endpoint in Marimo notebooks, which bypasses authentication checks and grants shell access.

Research details

Component/terminal/ws WebSocket endpoint (marimo/_server/api/endpoints/terminal.py)

PreconditionsMarimo must be running in edit mode on a platform that supports terminal functionality (Linux or macOS), and the server must be network-accessible on the WebSocket port (default 2718). The /terminal/ws endpoint performs no authentication check — it only verifies the server is in edit mode and the platform supports terminals before forking a PTY shell via pty.fork(). This means any attacker who can reach the Marimo server on the network can establish an unauthenticated WebSocket connection and obtain a full interactive shell with the privileges of the Marimo process (typically root in Docker deployments), without needing any credentials or user interaction. agent

DeliveryDirect WebSocket connection to /terminal/ws endpoint

Public PoCyes

PoC URLs https://github.com/0xdeadroot/CVE-2026-39987-marimo-rce
https://github.com/M3PH1569/CVE-2026-39987-POC
https://github.com/h3raklez/CVE-2026-39987
https://github.com/rootdirective-sec/CVE-2026-39987-Lab
https://github.com/mki9/CVE-2026-39987_exploit
https://github.com/0xBlackash/CVE-2026-39987 Third-party repos; verify before use.

Advisoryhttps://github.com/marimo-team/marimo/security/advisories/GHSA-2679-6mx9-h9xc

Exploit notesCVSS attack complexity: LOW | CRITICAL severity (CVSS >= 9.0) | No authentication required — trivial to exploit

SummaryMarimo Marimo | Multiple public PoCs found on GitHub | Vendor advisory located (GHSA-2679-6mx9-h9xc) | Exploited in the wild within ~10 hours of disclosure

Tia coverage

First reported2026-09-15

First exploit report2026-09-15

Exploit report → KEV145 days after the listing

When Tia's reporting first covered this CVE and whether a report claimed exploitation before the KEV listing. Lead-time deltas are measured from the exploitation report only — plain coverage is not exploitation intel. See the story links under Mentioned in for coverage detail.

Mentioned in

marimo-rce-flaw-lets-hackers-steal-aws-credentials-and-pivot-to

Record schema v1.0. Enrichment is research-grade, not a substitute for analyst review.