Critical 9.3Known exploited (CISA KEV)Published Apr 9, 2026

CVE-2026-39987marimo Affected by Pre-Auth Remote Code Execution via Terminal WebSocket Authentication Bypass

Updated under an hour ago (2026-10-19 06:30 UTC)

Does this affect you?

It affects marimo-team marimo and 1 other product. Add what you run to find out whether that includes you.

CISA lists it as known exploited since Apr 23, 2026; federal agencies had to remediate by May 7, 2026. Treat that date as your deadline.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for marimo-team marimo

Exploited in the last 30 days

marimo is a reactive Python notebook. Prior to 0.23.0, Marimo has a Pre-Auth RCE vulnerability. The terminal WebSocket endpoint /terminal/ws lacks authentication validation, allowing an unauthenticated attacker to obtain a full PTY shell and execute arbitrary system commands. Unlike other WebSocket endpoints (e.g., /ws) that correctly call validate_auth() for authentication, the /terminal/ws endpoint only checks the running mode and platform support before accepting connections, completely skipping authentication verification. This vulnerability is fixed in 0.23.0.

CVSS: 9.3 CRITICAL (v4.0, CNA)CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Weakness (CWE): CWE-306
Known exploited: Added to CISA KEV Apr 23, 2026; federal remediation due May 7, 2026Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
EPSS (exploitation in the next 30 days): 37.87% (percentile 99)
Assigned by: GitHub_M
NVD analysis: Analyzed
Record last updated: Apr 24, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

marimo-team marimo marimo_team:marimo (from the name)	before 0.23.0	CNA record
coreweave marimo coreweave:marimo	before 0.23.0	NVD

References

https://github.com/marimo-team/marimo/security/advisories/GHSA-2679-6mx9-h9xcx-refsource-confirm, exploit, mitigation, vendor-advisory
https://github.com/marimo-team/marimo/pull/9098x-refsource-misc, issue-tracking, patch
https://github.com/marimo-team/marimo/commit/c24d4806398f30be6b12acd6c60d1d7c68cfd12ax-refsource-misc, patch
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-39987us-government-resource
https://www.sysdig.com/blog/marimo-oss-python-notebook-rce-from-disclosure-to-exploitation-in-under-10-hoursexploit, third-party-advisory

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.