Marimo Notebook Flaw Could Run MCP Commands Before Cells Execute in Edit Mode
Marimo patched a high-severity code injection flaw, CVE-2026-75149, affecting versions before 0.23.15, in which a crafted notebook can supply an attacker-controlled MCP server command that runs as a local subprocess when the notebook is opened in edit...