Full research report
Marimo Notebook Flaw Could Run MCP Commands Before Cells Execute in Edit Mode
Executive assessment
CVE-2026-75149 is a notebook-originated code-injection issue rather than an exposed-service authentication bypass: the dangerous transition occurs when untrusted MCP metadata is accepted during edit-mode initialisation and reaches local subprocess creation. Marimo's fix treats notebook metadata as attacker-controlled, retaining only allowlisted configuration and removing sections capable of controlling MCP, AI, completion, secrets or server behaviour. CVE-2026-67618 demonstrates a second consequence of the same trust-boundary weakness—credential disclosure through an overridden AI endpoint—but requires a later AI request. The stronger exploitation evidence in the source material belongs solely to CVE-2026-39987, a separate terminal WebSocket flaw, so the current status for CVE-2026-75149 remains technically serious but not known to be exploited.
What happened
Marimo corrected CVE-2026-75149 in release 0.23.15 on 23 July 2026, before the CVE was published on 19 August and reported publicly on 25 August. A crafted notebook could place an attacker-controlled Model Context Protocol (MCP) command in its configuration; opening that notebook in edit mode caused Marimo to launch the command locally before any cell ran. The same release also corrected the related metadata-driven credential-exposure issue CVE-2026-67618.
Affected scope
CVE-2026-75149 affects Marimo releases before 0.23.15. Exploitation requires a victim to obtain and open a malicious notebook in edit mode, but does not require attacker authentication or deliberate cell execution. CVE-2026-67618 affects the same pre-0.23.15 range, while CVE-2026-39987 is a separate terminal WebSocket vulnerability affecting versions up to and including 0.20.4 and patched in 0.23.0.
Technical assessment
Marimo treated notebook-supplied PEP 723 metadata as configuration rather than consistently enforcing an untrusted-data boundary. For CVE-2026-75149, an MCP command from that metadata could reach local subprocess creation during notebook initialisation; for CVE-2026-67618, an attacker-controlled AI endpoint could receive an operator's API key after a later AI request. The 0.23.15 hardening change switched notebook configuration to an allowlist and removed sensitive sections such as mcp, ai, completion, secrets and server. No evidence reviewed established exploitation or a public exploit for CVE-2026-75149, and the exploitation of CVE-2026-39987 must not be attributed to the new flaw.
Recommended defensive actions
- Upgrade all Marimo installations to version 0.23.15 or later, using the latest supported stable release where possible.
- Inventory developer workstations, notebook services and container images for Marimo versions earlier than 0.23.15.
- Restrict the opening of externally sourced or unreviewed Marimo notebooks in edit mode until systems are upgraded.
- Hunt for unexpected child processes spawned by Marimo or Python when notebooks are opened, especially before any user-initiated cell execution.
- Review outbound connections and credential use associated with recently opened notebooks, and rotate exposed API keys where suspicious endpoints or notebook metadata are found.
- Segment notebook execution environments from production credentials and sensitive infrastructure, and enforce least-privilege service accounts.
Uncertainties and evidence gaps
- No confirmed exploitation, public PoC or attributable threat actor was found for CVE-2026-75149 in the reviewed evidence.
- The public CVE descriptions do not establish how widely vulnerable Marimo versions are deployed or how frequently users open notebooks from untrusted sources.
- NVD and OSV substantially reproduce the VulnCheck CNA description, so they corroborate the record but are not independent evidence of exploitation.
- CISA's exploitation finding applies only to the separate CVE-2026-39987 and provides no evidence that CVE-2026-75149 or CVE-2026-67618 has been exploited.
Vulnerability flow
Defender-oriented path reconstructed only from sourced report findings. Unknown stages are omitted.
No confirmed active exploitation or public PoC was identified for CVE-2026-75149; the separate CVE-2026-39987 was previously exploited and has a vendor-published PoC.
The investigation separated the 25 August report about CVE-2026-75149 from two contextual Marimo vulnerabilities. CNA, OSV and NVD records established the affected range and pre-cell subprocess trigger, while Marimo's commit and release confirmed that version 0.23.15 hardened the notebook-metadata boundary. Exploitation checks found that CISA's confirmation concerns only the older CVE-2026-39987, leaving exploitation of CVE-2026-75149 unconfirmed.
- What precise event and claims did the supplied report describe?Read the supplied article and separated the new MCP command-injection flaw from the related metadata issue and earlier terminal vulnerability.thehackernews.com ↗
The report identified CVE-2026-75149 as the focused event, with CVE-2026-67618 and CVE-2026-39987 supplied as distinct context.
why This prevented exploitation evidence for the older terminal flaw from being incorrectly attributed to the newly disclosed notebook flaw.
- What are the formal affected range, trigger and publication date?Reviewed the OSV vulnerability record and its linked source references.osv.dev ↗
The record states that versions before 0.23.15 are affected, publication occurred on 19 August 2026, and opening a crafted notebook in edit mode can launch an MCP command before cell execution.
why This established the core scope and trigger while confirming that deliberate cell execution is unnecessary.
- Does the assigning authority support the article's technical claim?Opened VulnCheck's CNA advisory for CVE-2026-75149.vulncheck.com ↗
VulnCheck classifies the issue as high severity, credits Gregory Tan and confirms unauthenticated, user-assisted command execution through an attacker-controlled MCP server entry.
why The CNA record is the strongest direct vulnerability description and supports the event's central claim.
- What exactly changed in the vendor's code?Inspected Marimo's PEP 723 hardening commit and its regression tests.github.com ↗
The change introduced allowlisting for script configuration and drops notebook-supplied ai, mcp, completion, secrets and server sections; tests verify removal of an attacker-controlled MCP entry.
why The code change independently confirms the vulnerable trust boundary and provides the technical basis for the mitigation.
- Which vendor release contains the correction?Reviewed Marimo's 0.23.15 release page.github.com ↗
Marimo released version 0.23.15 on 23 July 2026, and the hardening commit is tagged with that release.
why This verifies the fixed-version boundary and shows that the correction preceded public CVE publication.
- Does government evidence confirm exploitation of this vulnerability?Queried CISA's Known Exploited Vulnerabilities catalogue data for the stated Marimo CVE.cisa.gov ↗
CISA lists CVE-2026-39987 as exploited and added it on 23 April 2026, but does not provide that status for CVE-2026-75149.
why The exploitation claim applies to a separate earlier vulnerability and cannot support a finding of active exploitation for this story's focused CVE.
- How does CVE-2026-67618 relate to the same boundary?Read the CNA advisory for the related credential-exposure vulnerability.vulncheck.com ↗
Pre-0.23.15 notebook metadata could override an AI base URL and send an operator's API key to an attacker-controlled endpoint after the operator made an AI request.
why This confirms that CVE-2026-67618 shares the metadata trust boundary but has a different trigger and impact from CVE-2026-75149.
- What evidence exists for the earlier exploited Marimo flaw?Reviewed Marimo's vendor advisory for CVE-2026-39987.github.com ↗
The advisory describes a missing authentication check on the terminal WebSocket endpoint, affected versions up to 0.20.4, a fix in 0.23.0 and a public PoC.
why This validates the historical context while showing that its network-accessible authentication bypass is technically distinct from the malicious-notebook workflow.
- Does a government vulnerability database corroborate the focused CVE record?Reviewed NVD's entry for CVE-2026-75149.nvd.nist.gov ↗
NVD records CWE-94, a high-severity CNA score and the same pre-0.23.15 command-execution behaviour, but notes VulnCheck as the source.
why The record corroborates classification and scope, while its sourcing means it is not independent proof of exploitation.
Research coverage
All 67 registered source leaves were evaluated for this run: 59 completed, 0 were unavailable, 1 failed and 7 were disabled. For this story, 4 registered sources supplied useful evidence (2 primary, 1 corroborating, 1 contextual and 0 PoC/exploit references). 55 completed sources contained no matched information for this story.
Complete source-by-source audit 67 sources
| Source | Run result | Value | Why it was useful — or not |
|---|---|---|---|
| CISA KEVkev | ok1676 records | Primary evidence2 matched items | Confirmed that a related CVE is listed in CISA's Known Exploited Vulnerabilities catalogue. Supplied a vendor or government advisory opened and verified during focused research. |
| The Hacker Newsnews | ok10 records | Primary evidence1 matched items | Published the source report used to frame and date the event. |
| CISA Alertsnews | ok empty0 records | Corroborating1 matched items | A page from this source was opened and verified during focused research. |
| FIRST EPSSepss | ok7970 records | Context1 matched items | Added exploitation-probability context; EPSS does not itself prove exploitation. |
| AlienVault OTXdark_web | ok10 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| BleepingComputernews | ok10 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| CIRCL CVEcve | ok30 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Cisco PSIRTvendor_advisory | ok5332 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Cisco Talosnews | ok1 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI CVE most exploiteddeepdarkcti | ok94 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI Discorddeepdarkcti | ok7 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI exploitsdeepdarkcti | ok24 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI forumsdeepdarkcti | ok264 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI malware as a servicedeepdarkcti | ok7 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI malware samplesdeepdarkcti | ok3 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI marketsdeepdarkcti | ok127 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI phishingdeepdarkcti | ok19 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI ransomware gangsdeepdarkcti | ok687 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI RATsdeepdarkcti | ok1 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI Telegram infostealerdeepdarkcti | ok130 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI Telegram threat actorsdeepdarkcti | ok1012 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI Twitter threat actorsdeepdarkcti | ok39 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Exploit-DBexploit_reference | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Fortinet PSIRTvendor_advisory | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| GitHub topic: cveresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| GitHub topic: exploitresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| GitHub topic: penetration-testingresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| GitHub topic: pocresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| GitHub topic: vulnerabilityresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| GreyNoiseexploit_reference | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| KrebsOnSecuritynews | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| LinkedIn RSS proxy feeds (disabled)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| MalwareBazaardark_web | ok3 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #cveresearch | ok20 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #cybersecurityresearch | ok17 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #exploitresearch | ok20 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #infosecresearch | ok19 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #malwareresearch | ok19 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #ransomwareresearch | ok20 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #threatintelresearch | ok16 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #vulnerabilityresearch | ok19 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Metasploit module metadataexploit_reference | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Microsoft MSRCvendor_advisory | ok1591 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Microsoft Securitynews | ok1 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| MISP Galaxyresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| MISP threat actor galaxyactor | ok0 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| NVDcve | failed0 records | Failed1 matched items | The current collection attempt failed; this source cannot support the report. |
| Palo Alto Networks PSIRTvendor_advisory | ok25 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| ProjectDiscovery nuclei templatesexploit_reference | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Rapid7news | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Reddit r/AskNetsec (pending API approval)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| Reddit r/cybersecurity (pending API approval)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| Reddit r/malware (pending API approval)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| Reddit r/netsec (pending API approval)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| Reddit r/ReverseEngineering (pending API approval)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| SANS ISCnews | ok1 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Shadowserver public aggregate honeypot observationsexploit_reference | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Shodanresearch | ok2 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Sigma Rulesresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Sophos IOCsresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| ThreatFoxthreat_intelligence | ok100 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| UK NCSCnews | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Unit42 IOCsresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| URLhausdark_web | ok10 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| VirusTotal Community IOC enrichmentresearch | ok4 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| VulnCheck KEVkev | ok500 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Vulnerability Lookupcve | ok30 records | Checked — no match | The source completed, but none of its retained records matched this story. |
Additional verified pages 10 opened outside the registered collection
Vulnerability & exploitation2
Technical references4
Repository captured from the source article as technical context; not validated as PoC or exploit code.
Repository captured from the source article as technical context; not validated as PoC or exploit code.
Repository captured from the source article as technical context; not validated as PoC or exploit code.
Repository captured from the source article as technical context; not validated as PoC or exploit code.
PoC & exploit code1
Vendor advisory includes a PoC for the separate, earlier CVE-2026-39987, not CVE-2026-75149.
Vendor & gov advisories5
CVE Numbering Authority record confirming CVE-2026-75149, affected versions, trigger and severity.
Government vulnerability record corroborating the code-injection classification and version boundary.
Confirms exploitation of the separate earlier CVE-2026-39987; it does not list CVE-2026-75149.
Documents related metadata-boundary weakness CVE-2026-67618, fixed by the same release.
Analysis & research3
Vendor code change allowlists notebook-supplied configuration and removes sensitive sections including mcp, ai, completion, secrets and server.
Records the publication date, affected range, CWE-94 classification and links to the fix.
Initial reporting that distinguished the new notebook flaw from two earlier Marimo vulnerabilities.