⚠️ CVE-2026-39987 — Unauthenticated Shell in marimo (< 0.23.0)

A reactive Python notebook tool gave attackers a full shell in one WebSocket request.

📌 Overview

CVE-2026-39987 is a critical pre-auth RCE vulnerability in marimo — a popular open-source reactive notebook for Python (modern Jupyter alternative).

• Affected versions: All versions < 0.23.0 (officially confirmed)
• CVSS Score: 9.3 (Critical)
• Type: Missing authentication on /terminal/ws WebSocket endpoint
• Impact: Unauthenticated attackers could open a full interactive PTY shell and execute arbitrary commands on the server.

Exploitation was observed in the wild within ~10 hours of the public disclosure — no public exploit code was needed.

🛠️ Technical Details

The /terminal/ws endpoint only checked running mode and platform support.
Unlike other endpoints (e.g. /ws), it skipped validate_auth() entirely.

This allowed any unauthenticated user who could reach the marimo server to:

• Spawn a full terminal shell
• Explore the filesystem
• Steal credentials
• Execute arbitrary system commands

📷 Screenshot

✅ Fixed In

marimo 0.23.0 (released April 2026)

Patch: Proper authentication validation was added to the terminal WebSocket endpoint.

pip install --upgrade "marimo>=0.23.0"

Official Advisory:
GHSA-2679-6mx9-h9xc

Patch Commit:
marimo-team/marimo@c24d480

🚨 Recommendations

• Upgrade immediately to marimo ≥ 0.23.0
• Enable strong authentication when running marimo
• Avoid exposing marimo directly to the internet unless necessary
• Use network segmentation, reverse proxies with auth, or container isolation
• Scan your environments with tools like pip-audit, Dependabot, or OSV

📊 Timeline

• Disclosure: April 9, 2026
• First exploitation: ~9–10 hours after disclosure
• Fix released: April 2026 (v0.23.0)

🔗 References

• NVD - CVE-2026-39987
• marimo GitHub Security Advisory
• The Hacker News Coverage
• Sysdig Threat Research