CVE-2026-39987 PoC

Summary

Marimo <= 0.20.4 is affected by a pre-authentication RCE vulnerability in the /terminal/ws WebSocket endpoint.

The endpoint checks the application mode and terminal support, but does not validate authentication before accepting the WebSocket connection. It then creates a PTY shell, allowing an unauthenticated attacker to execute commands with the privileges of the Marimo process.

Root Cause

Unlike other WebSocket endpoints that call validate_auth(), the vulnerable terminal endpoint accepts the connection directly:

if app_state.mode != SessionMode.EDIT:
    await websocket.close(...)
    return

if not supports_terminal():
    await websocket.close(...)
    return

await websocket.accept()
child_pid, fd = pty.fork()

The missing authentication check allows unauthenticated access to the PTY.

Affected Versions