Marimo Notebook Flaw Could Run MCP Commands Before Cells Execute in Edit Mode
Summary: Marimo patched a high-severity code injection flaw, CVE-2026-75149, affecting versions before 0.23.15, in which a crafted notebook can supply an attacker-controlled MCP server command that runs as a local subprocess when the notebook is opened in edit mode, before any cell executes. VulnCheck's CNA record assigns it a CVSS v4 score of 8.7 and a CVSS v3.1 score of 8.8, with user interaction required and no attacker authentication, and the CVE was published on August 19.
Why it matters: The command fires before a single cell runs, so a reviewer who opens a shared notebook in edit mode to inspect it is the trigger, and no authentication stands in the way. A related flaw, CVE-2026-67618, showed the same notebook-metadata boundary could send an operator's API key to an attacker-controlled endpoint on the next AI request.
Read the original at The Hacker News ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2026-39987CVE-2026-67618CVE-2026-75149
- Related
- CVE-2026-39987: Marimo Remote Code Execution Vulnerability Known Exploited Vulnerabilities · Apr 23, 2026