Critical Marimo RCE Flaw Could Let Attackers Execute Malicious Code Remotely

Gbhackers •Divya • May 18, 2026

A newly disclosed critical vulnerability in the Marimo Python notebook framework is raising serious alarms across the cybersecurity community, as it allows attackers to execute arbitrary commands remotely, without authentication. Tracked as CVE-2026-39987, the flaw exposes a WebSocket endpoint that can be abused to spawn a system-level shell, potentially leading to full infrastructure compromise. Marimo RCE […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical Marimo RCE Flaw Exposes Systems to Remote Attacks A critical vulnerability in the Marimo Python notebook framework, tracked as CVE-2026-39987, allows attackers to execute arbitrary commands remotely without authentication. The flaw, stemming from a missing authentication check in a WebSocket endpoint, enables pre-authentication remote code execution (RCE) and could lead to full system compromise. Security experts have confirmed that this vulnerability is actively being exploited in the wild. Organizations using the Marimo framework are at risk, particularly those with exposed WebSocket terminals. The vulnerability was published on April 9, 2026, and was added to the CISA KEV list for active exploitation on April 23, 2026. A proof of concept (PoC) was made public shortly after its disclosure on April 13, 2026. Immediate action is recommended for affected systems to mitigate potential attacks. 2 sources 73

Extracted Entities

Critical Marimo RCE Flaw Could Let Attackers Execute Malicious Code Remotely

The full story

Extracted Entities

Attack Types (1)

CVEs (1)

CWE Weaknesses (2)

MITRE ATT&CK (1)

Platforms (1)