Critical Marimo RCE Flaw Exposes Systems to Remote Attacks

A critical vulnerability in the Marimo Python notebook framework, tracked as CVE-2026-39987, allows attackers to execute arbitrary commands remotely without authentication. The flaw, stemming from a missing authentication check in a WebSocket endpoint, enables pre-authentication remote code execution (RCE) and could lead to full system compromise. Security experts have confirmed that this vulnerability is actively being exploited in the wild. Organizations using the Marimo framework are at risk, particularly those with exposed WebSocket terminals. The vulnerability was published on April 9, 2026, and was added to the CISA KEV list for active exploitation on April 23, 2026. A proof of concept (PoC) was made public shortly after its disclosure on April 13, 2026. Immediate action is recommended for affected systems to mitigate potential attacks.

Key Points: • CVE-2026-39987 allows remote code execution without authentication. • The vulnerability is actively exploited, posing a significant risk to exposed systems. • Organizations using the Marimo framework should apply security updates immediately.