216.73.217.22

CVE-2026-39987

· Published 09/04/2026 20:17 · Modified 29/04/2026 16:34 · Author: The MITRE Corporation

Labels: CVE-2026-39987 2026-04-09CVE-2026-39987CWE-306[email protected]

Essential information

Published
09/04/2026 20:17
Modified
29/04/2026 16:34
Author
The MITRE Corporation
Creator
The MITRE Corporation
CVSS
9.8 CRITICAL (v3.1) 9.3 CRITICAL (v4.0)
CISA KEV
Yes
CWE
CWE-306
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS metrics

Description

marimo is a reactive Python notebook. Prior to 0.23.0, Marimo has a Pre-Auth RCE vulnerability. The terminal WebSocket endpoint /terminal/ws lacks authentication validation, allowing an unauthenticated attacker to obtain a full PTY shell and execute arbitrary system commands. Unlike other WebSocket endpoints (e.g., /ws) that correctly call validate_auth() for authentication, the /terminal/ws endpoint only checks the running mode and platform support before accepting connections, completely skipping authentication verification. This vulnerability is fixed in 0.23.0.

NVD status

Status
Received — CVE has been recently published to the CVE List and has been received by the NVD.
Source
[email protected]
NVD
View on NVD

Affected products (CPE)

ProductCPE
marimo / marimo cpe:2.3:a:marimo:marimo:<0.23.0:*:*:*:*:*:*:*

References