mki9/cve-2026-39987_exploitExploit for Marimo pre-auth RCE via WebSocket auth bypass, providing interactive shell access on affected versions.
** Exploitation Framework ** | Full Remote Code Execution (RCE) | WebSocket Auth Bypass
Open the file website.html
This exploit targets Marimo applications running WebSocket on port 2718 (default). The vulnerability allows unauthenticated command execution through a WebSocket authentication bypass, granting attackers full remote code execution capabilities.
| Attribute | Details |
|---|---|
| CVE ID | CVE-2026-39987 |
| Attack Vector | WebSocket Auth Bypass |
| Shell Type | Interactive PTY (Pseudo-Terminal) |
| Impact | Full Remote Code Execution (RCE) |
| CVSS Score | 9.3 (Critical) |
| Affected Versions | Marimo ≤ 0.20.4 |
The vulnerability exists in the WebSocket handshake mechanism of Marimo applications. Due to improper authentication validation, an attacker can:
Root Cause: Missing authentication check in the WebSocket upgrade handler allows unauthenticated command injection.
# Clone the repository
python3 -m venv venv
source venv/bin/activate
git clone https://github.com/mki9/CVE-2026-39987_exploit.git
cd CVE-2026-39987_exploit
chmod +x *
# Exploit Commands
* / Interactive Shell (Default)
1 / python CVE-2026-39987_exploit.py <TARGET_IP>
* / help
2 / python CVE-2026-39987_exploit.py
# Install required dependencies
pip install websocket-client colorama rich pyfiglet
python CVE-2026-39987_scanner.py
# Enter
[*] Weaponized WebSocket Exploit Test
[!] Authorized Use Only
[?] Enter target IP address or hostname:
>> <TARGET_IP>