CVE-2026-39987
About
marimo is a reactive Python notebook. Prior to 0.23.0, Marimo has a Pre-Auth RCE vulnerability. The terminal WebSocket endpoint /terminal/ws lacks authentication validation, allowing an unauthenticated attacker to obtain a full PTY shell and execute arbitrary system commands. Unlike other WebSocket endpoints (e.g., /ws) that correctly call validate_auth() for authentication, the /terminal/ws endpoint only checks the running mode and platform support before accepting connections, completely skipping authentication verification. This vulnerability is fixed in 0.23.0.
Rainforest analyst review
marimo is a reactive Python notebook, and its terminal WebSocket endpoint at /terminal/ws skips authentication entirely. Where other WebSocket endpoints such as /ws correctly call validate_auth() before accepting a connection, /terminal/ws only checks the running mode and platform support, then hands the caller a connection. That connection is a full PTY shell, so an unauthenticated attacker who can reach the endpoint gets an interactive terminal and runs arbitrary system commands as the user running marimo, with no credentials at any step.
Notebook servers like marimo tend to be run on developer workstations, shared analysis hosts, and increasingly on network-accessible interfaces so teams can collaborate, and they routinely have access to data, credentials, and compute that make a shell on them valuable. A pre-auth PTY is about as direct a compromise primitive as exists, requiring only network reachability to the endpoint. Upgrade to marimo 0.23.0 or later, and in the meantime ensure any marimo instance is bound to localhost or placed behind an authenticating proxy and never exposed to untrusted networks. Any server that ran a network-reachable vulnerable version should be checked for unexpected commands and processes.
References
- https://github.com/marimo-team/marimo/commit/c24d4806398f30be6b12acd6c60d1d7c68cfd12a
- https://github.com/marimo-team/marimo/pull/9098
- https://github.com/marimo-team/marimo/security/advisories/GHSA-2679-6mx9-h9xc
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-39987
- https://www.sysdig.com/blog/marimo-oss-python-notebook-rce-from-disclosure-to-exploitation-in-under-10-hours
Related CVEs
Frequently asked questions
What is CVE-2026-39987?
marimo is a reactive Python notebook. Prior to 0.23.0, Marimo has a Pre-Auth RCE vulnerability. The terminal WebSocket endpoint /terminal/ws lacks authentication validation, allowing an unauthenticated attacker to obtain a full PTY shell and execute arbitrary system commands.
How severe is CVE-2026-39987?
CVE-2026-39987 carries a CVSS 3.1 base score of 9.8, rated critical. On the Rainforest Risk Index — which weighs the severity alongside how easy the flaw is to reach and how broad its impact is — it scores 99 out of 100, in the critical band.
How is CVE-2026-39987 exploited?
According to the CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H): attack vector Network, attack complexity Low, privileges required None, user interaction None. Impact on confidentiality High, integrity High and availability High.
Which products are affected by CVE-2026-39987?
Public advisories list the following as affected: marimo. Check the references on this page for the exact versions each vendor confirms.
How do I fix CVE-2026-39987?
Apply the fix the vendor published — the references on this page link to the primary advisories and patches. When patching can't happen right away, reduce the exposure of the affected component and watch it for exploitation attempts. Rainforest customers see this vulnerability correlated to their own assets and prioritized by real exposure, not by score alone.
Empower Your Security Strategy with Rainforest
Discover vulnerabilities early, prioritize critical threats, and protect what truly matters. Rainforest streamlines your security operations, saving you time and reducing costs, so you can focus on what drives your business forward.