Marimo RCE Vulnerability Exploited Within 10 Hours of Public Disclosure

Gbhackers •Divya • April 13, 2026

A critical remote code execution (RCE) vulnerability in the open-source Python notebook platform Marimo was actively exploited less than 10 hours after its public disclosure. The flaw, initially tracked as GHSA-2679-6mx9-h9xc and later assigned CVE-2026-39987, carries a critical CVSS score of 9.3. It allows unauthenticated attackers to gain a full interactive shell on exposed Marimo […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical RCE Vulnerability in Marimo Exploited Within 10 Hours of Disclosure A critical pre-authentication remote code execution (RCE) vulnerability in Marimo, an open-source Python notebook platform, was disclosed on April 8, 2026, and exploited within 9 hours and 41 minutes. The vulnerability, tracked as CVE-2026-39987, allows unauthenticated attackers to gain full control of affected Marimo instances by connecting to the terminal WebSocket endpoint (/terminal/ws) without any credentials. The flaw affects all versions prior to 0.23.0, with a CVSS score of 9.3. Attackers were able to execute arbitrary commands and exfiltrate sensitive information, including AWS access keys, in under three minutes. The rapid exploitation indicates that threat actors are actively monitoring vulnerability disclosures for even niche software. Marimo has approximately 20,000 GitHub stars and is primarily used by data scientists and developers. Users are advised to upgrade to version 0.23.0 immediately to mitigate the risk. 10 sources 78

Extracted Entities

Marimo RCE Vulnerability Exploited Within 10 Hours of Public Disclosure

The full story

Extracted Entities

Attack Types (1)

CVEs (1)

MITRE ATT&CK (1)

Platforms (1)