Critical Marimo Security Vulnerability Enables Remote Code Execution Attacks

Cybersecuritynews •Abinaya • May 19, 2026

A critical security vulnerability in the Marimo Python notebook framework is being actively exploited to achieve pre-authentication remote code execution (RCE), allowing attackers to gain full control of exposed systems. Tracked as CVE-2026-39987, the flaw stems from a missing authentication check in a WebSocket terminal endpoint, enabling attackers to spawn system-level shells without logging in. Security […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical Marimo RCE Flaw Exposes Systems to Remote Attacks A critical vulnerability in the Marimo Python notebook framework, tracked as CVE-2026-39987, allows attackers to execute arbitrary commands remotely without authentication. The flaw, stemming from a missing authentication check in a WebSocket endpoint, enables pre-authentication remote code execution (RCE) and could lead to full system compromise. Security experts have confirmed that this vulnerability is actively being exploited in the wild. Organizations using the Marimo framework are at risk, particularly those with exposed WebSocket terminals. The vulnerability was published on April 9, 2026, and was added to the CISA KEV list for active exploitation on April 23, 2026. A proof of concept (PoC) was made public shortly after its disclosure on April 13, 2026. Immediate action is recommended for affected systems to mitigate potential attacks. 2 sources 73

Extracted Entities

Critical Marimo Security Vulnerability Enables Remote Code Execution Attacks

The full story

Extracted Entities

Attack Types (1)

CVEs (1)

CWE Weaknesses (1)

MITRE ATT&CK (2)

Platforms (1)