CVE-2026-39987 is a critical pre-authentication Remote Code Execution (RCE) vulnerability affecting Marimo, a reactive Python notebook environment. The vulnerability is located in the terminal WebSocket endpoint /terminal/ws.

🔍 Root Cause

The vulnerable terminal endpoint creates an interactive PTY after accepting a WebSocket connection.

Conceptually, the vulnerable request flow is:

The important security boundary is the missing authentication check.

An endpoint exposing arbitrary command execution must not allow an unauthenticated client to reach the PTY creation logic.

🎯 Purpose and Scope

Primary Objective

The purpose of this project is to demonstrate, in a controlled environment, the missing authentication enforcement affecting Marimo's terminal WebSocket endpoint.

Security teams can use the project to:

• Validate exposure of their Marimo instances
• Verify the effectiveness of security patches
• Document potential security impact
• Improve defensive controls
• Support authorized vulnerability validation

Authorized Environments

• Security laboratories owned by the tester
• Systems with explicit written authorization
• Training and educational environments
• Authorized penetration tests and security assessments

Warning: Run the PoC only against systems you own or are explicitly authorized to test.

🔗 Exploitation Chain

The complete vulnerability chain can be summarized as follows:

The critical security failure occurs at step 3.

📦 Installation

Requirements

Dependencies

Verification

🚀 Usage Guide

Basic Syntax

Practical Examples

1. Local Laboratory Test

2. Authorized Remote Test

3. Debug Mode

📋 Parameter Reference

🔄 Exploit Workflow

🧪 Validation Tests

Test Scenarios

Vulnerable Instance

Expected Result: The vulnerable terminal endpoint accepts the unauthenticated connection.

Patched Instance

Expected Result: The connection is rejected or otherwise prevented by the authentication controls.

Timeout Test

Expected Result: The timeout is reported cleanly.

📈 Vulnerability Statistics

The source README classifies the issue as CVSS 9.3 Critical and identifies CWE-306, WebSocket as the protocol, and /terminal/ws as the affected endpoint.

🔎 Detection

Potential indicators of exploitation include unexpected WebSocket connections to:

Defenders should investigate:

• Unexpected connections to the terminal WebSocket endpoint
• Unexpected shell processes spawned by Marimo
• Suspicious child processes
• Unexpected outbound connections
• Access to sensitive environment variables
• Unexpected filesystem activity
• Unknown commands executed by the Marimo process

🛡️ Remediation

Upgrade Marimo to a fixed release:

Additional defensive recommendations include:

• Do not expose Marimo directly to the public Internet unless necessary.
• Place notebook services behind an authenticated reverse proxy.
• Restrict network access to trusted users and networks.
• Run Marimo with the minimum privileges required.
• Avoid mounting sensitive host directories into containers.
• Rotate credentials that may have been accessible to compromised instances.
• Review logs for suspicious /terminal/ws activity.
• Investigate potentially compromised instances instead of assuming that patching alone removes attacker persistence.

🔐 Security Classification

📄 License

AUTHORIZED USE ONLY

This project is provided exclusively for:

• Authorized security testing
• Academic research
• Vulnerability validation
• Security training
• Defensive security development

Unauthorized use is strictly prohibited and may violate applicable local and international laws.

⚠️ Disclaimer

This project is provided for security research, vulnerability validation, and educational purposes.

Do not use the PoC against systems that you do not own or do not have explicit authorization to test.

The maintainers are not responsible for misuse, unauthorized testing, damage, data loss, or any consequences resulting from the use of this project.