Typical Marimo Deployment:

  ┌──────────────┐         ┌────────────────────────────────┐
  │              │  HTTP   │          Marimo Server         │
  │   Browser    │────────>│                                │
  │   (User)     │         │  ┌──────────────────────────┐  │
  │              │<────────│  │  /ws (Notebook)          │  │
  └──────────────┘  WS     │  │  ✅ validate_auth()     │  │
                           │  └──────────────────────────┘  │
                           │                                │
                           │  ┌──────────────────────────┐  │
                           │  │  /terminal/ws            │  │
                           │  │  ❌ NO AUTH CHECK        │  │
                           │  └──────────────────────────┘  │
                           │                                │
                           │  ┌──────────────────────────┐  │
                           │  │  Python Environment      │  │
                           │  │  .env files              │  │
                           │  │  AWS credentials         │  │
                           │  │  API keys                │  │
                           │  └──────────────────────────┘  │
                           └────────────────────────────────┘

  Authentication Flow Comparison:

  /ws (Notebook WebSocket):
  ┌─────────┐    ┌───────────────┐    ┌──────────┐    ┌───────────┐
  │ Connect │───>│ validate_auth │───>│  Accept  │───>│ Notebook  │
  └─────────┘    └───────┬───────┘    └──────────┘    └───────────┘
                         │
                    ❌ Reject if
                    not authenticated

  /terminal/ws (Terminal WebSocket):
  ┌─────────┐    ┌───────────────┐    ┌──────────┐    ┌───────────┐
  │ Connect │───>│ Check mode &  │───>│  Accept  │───>│ PTY Shell │
  └─────────┘    │ platform only │    └──────────┘    └───────────┘
                 └───────────────┘
                 ⚠️ No auth check!
                 Anyone gets a shell!

# /ws (Notebook) — CORRECT implementation
async def websocket_connect(self, message):
    await self.validate_auth()      # ✅ Checks authentication
    await self.accept()
    # ... notebook communication

# /terminal/ws (Terminal) — VULNERABLE implementation
async def websocket_connect(self, message):
    if not self.is_running_mode():  # Only checks mode
        await self.close()
        return
    if not self.is_platform_supported():  # Only checks platform
        await self.close()
        return
    await self.accept()             # ❌ No auth! Anyone gets a shell
    # ... PTY shell creation

  ┌──────────────────────────────────────────────────────────────┐
  │                   CVE-2026-39987 Timeline                    │
  ├──────────────────────────────────────────────────────────────┤
  │                                                              │
  │  T+0h        Advisory published                              │
  │  ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─                       │
  │  T+9h        First exploit built from advisory               │
  │  T+10h       Exploitation in the wild confirmed              │
  │  ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─                       │
  │  T+10h 0m    Attacker connects to /terminal/ws               │
  │  T+10h 1m    Full PTY shell obtained                         │
  │  T+10h 2m    .env file located and read                      │
  │  T+10h 3m    AWS keys exfiltrated                            │
  │              Total attack time: ~3 minutes                   │
  └──────────────────────────────────────────────────────────────┘

  Step 1: Attacker opens WebSocket connection to /terminal/ws
          (No authentication needed, no special tools required)

  Step 2: Server creates a PTY (pseudo-terminal) session
          Attacker now has an interactive shell

  Step 3: Attacker runs commands:
          $ cat .env
          AWS_ACCESS_KEY_ID=AKIA...
          AWS_SECRET_ACCESS_KEY=...
          DATABASE_URL=postgres://...
          OPENAI_API_KEY=sk-...

  Step 4: Credentials exfiltrated
          Attacker now has cloud access, database access,
          and API keys for AI services

  Total time: under 3 minutes
  Authentication required: none
  Tools required: any WebSocket client

  ┌─────────────────────────────────────────────────┐
  │        Why AI/ML Tools Are Prime Targets        │
  ├─────────────────────────────────────────────────┤
  │                                                 │
  │  1. DESIGNED to execute arbitrary code          │
  │     (that's literally what notebooks do)        │
  │                                                 │
  │  2. Run with elevated privileges                │
  │     (GPU access, cloud SDKs, network access)    │
  │                                                 │
  │  3. Contain high-value credentials              │
  │     (AWS keys, API tokens, DB connections)      │
  │                                                 │
  │  4. Often exposed to the network                │
  │     (for collaboration and remote access)       │
  │                                                 │
  │  5. Security hardening is an afterthought       │
  │     (focus on features and UX, not security)    │
  │                                                 │
  │  6. Users are researchers, not security experts │
  │     (default configs, weak passwords, no VPN)   │
  └─────────────────────────────────────────────────┘

# Install dependencies
pip install -r requirements.txt

# Single target (Marimo default port: 2718)
python CVE-2026-39987_Marimo_RCE_detector.py -t http://marimo-host:2718

# HTTPS target
python CVE-2026-39987_Marimo_RCE_detector.py -t https://marimo-host:443

# Bulk scan from file with verbose output
python CVE-2026-39987_Marimo_RCE_detector.py -f targets.txt -o results.json -v

# Increased timeout for slow networks
python CVE-2026-39987_Marimo_RCE_detector.py -t http://10.0.0.5:2718 --timeout 15

[*] CVE-2026-39987 Marimo Pre-Auth RCE Scanner
[*] Scanning 1 target(s)...
[*] NOTE: This scanner only checks for endpoint exposure.
[*]       No commands are executed on target systems.

======================================================================
Target: http://10.0.0.5:2718
Scan Time: 2026-04-14T16:00:00Z
Risk Level: CRITICAL
======================================================================
  Is Marimo:             YES
  Marimo Version:        0.19.2
  /terminal/ws Open:     YES — UNAUTHENTICATED
  Vulnerable:            YES

  *** CRITICAL: Pre-authenticated RCE is possible! ***
  *** An attacker can get a full PTY shell without any auth ***

  Details:
    - Marimo instance detected via /api/status
    - Marimo version: 0.19.2
    - WebSocket upgrade accepted — /terminal/ws accessible WITHOUT auth
    - CONFIRMED: /terminal/ws accepts unauthenticated connections while
      /ws requires auth — classic CVE-2026-39987 signature
    - Version 0.19.2 <= 0.20.4 — VULNERABLE to pre-auth RCE

======================================================================
[*] Scan Complete: 1 targets scanned
[*] Marimo Instances: 1 | Vulnerable: 1 | Critical: 1
======================================================================

# Install the NSE script
sudo cp CVE-2026-39987_Marimo_RCE.nse /usr/share/nmap/scripts/
sudo nmap --script-updatedb

# Basic scan (Marimo default port: 2718)
nmap -p 2718 --script CVE-2026-39987_Marimo_RCE <target>

# Scan common ports where Marimo might run
nmap -p 2718,8080,8443,443 --script CVE-2026-39987_Marimo_RCE <target>

# Subnet scan
nmap -p 2718 --script CVE-2026-39987_Marimo_RCE 10.0.0.0/24

# Scan targets from a file
nmap -p 2718 --script CVE-2026-39987_Marimo_RCE -iL targets.txt

# With service version detection
nmap -sV -p 2718 --script CVE-2026-39987_Marimo_RCE <target>

PORT     STATE SERVICE
2718/tcp open  http
| CVE-2026-39987_Marimo_RCE:
|   VULNERABLE:
|   Marimo Pre-Auth RCE (CVE-2026-39987)
|     State: VULNERABLE
|     Risk level: CRITICAL
|     Marimo Version: 0.19.2
|     /terminal/ws: accessible without authentication
|     Description:
|       The Marimo /terminal/ws WebSocket endpoint accepts connections
|       without authentication, enabling pre-authenticated RCE.
|       An attacker can obtain a full PTY shell without any credentials.
|     References:
|_      https://nvd.nist.gov/vuln/detail/CVE-2026-39987

# Check Marimo version via API
curl -s http://<TARGET>:2718/api/status | python3 -m json.tool

# Test WebSocket upgrade on /terminal/ws (should NOT succeed without auth)
curl -s -o /dev/null -w "%{http_code}" \
  -H "Upgrade: websocket" \
  -H "Connection: Upgrade" \
  -H "Sec-WebSocket-Key: dGVzdC1rZXktMTIzNDU2Nzg=" \
  -H "Sec-WebSocket-Version: 13" \
  http://<TARGET>:2718/terminal/ws

# If it returns 101 (Switching Protocols), the endpoint is open without auth
# If it returns 401/403, authentication is enforced (patched or hardened)

# For comparison, test /ws (should always require auth)
curl -s -o /dev/null -w "%{http_code}" \
  -H "Upgrade: websocket" \
  -H "Connection: Upgrade" \
  -H "Sec-WebSocket-Key: dGVzdC1rZXktMTIzNDU2Nzg=" \
  -H "Sec-WebSocket-Version: 13" \
  http://<TARGET>:2718/ws

# Check for active WebSocket connections
ss -tnp | grep <MARIMO_PORT>

# Review process tree for unexpected shells
ps aux --forest | grep -A5 marimo

# Check if .env or credential files were recently accessed
stat .env
stat ~/.aws/credentials

# Review cloud provider activity logs for unauthorized access
aws cloudtrail lookup-events --lookup-attributes AttributeKey=AccessKeyId,AttributeValue=<KEY_ID>

# Check for unauthorized outbound connections
netstat -tnp | grep ESTABLISHED | grep -v 127.0.0.1