CVE-2026-39987 Marimo-Team Marimo
marimo is a reactive Python notebook. Prior to 0.23.0, Marimo has a Pre-Auth RCE vulnerability. The terminal WebSocket endpoint /terminal/ws lacks authentication validation, allowing an unauthenticated attacker to obtain a full PTY shell and execute…
- CVSS
- 9.3 Critical
- EPSS
- 100%
- Percentile
- 100
- Published
- 2026-04-09
- Force
- 10 of 12
- Public PoC
- 31
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
On CISA’s exploited list
Marimo Remote Code Execution Vulnerability
- Added
- 2026-04-23
- Federal patch deadline
- 2026-05-07
- Ransomware use
- not known