CVE-2026-39987 - marimo Terminal WebSocket Authentication Bypass (poc)

Overview

This repository contains CVE-2026-39987 affecting marimo versions before 0.23.0.

The vulnerability exists in the terminal WebSocket endpoint, where insufficient authentication enforcement may allow an unauthenticated remote user to access terminal functionality under certain deployment conditions.

This was used in a CTF so the code will not work out of the box and needs tweaking

Affected Versions

Impact

An attacker who can reach the affected marimo service may be able to interact with the terminal endpoint without proper authorization.

Potential impact includes:

• Unauthorized command execution in the context of the marimo process
• Exposure of files and data accessible to the service account
• Possible compromise of connected resources depending on deployment permissions

Installation

OSX/Linux

git clone https://github.com/vanhari/CVE-2026-39987.git
cd CVE-2026-39987

Usage

python3 exp.py

Disclaimer This tool is provided for educational and research purposes only. The creator assumes no responsibility for any misuse or damage caused by the tool.