Marimo Notebook Flaw Allows Command Execution in Edit Mode

Marimo, a popular notebook software, has addressed a high-severity security flaw that could allow attackers to execute arbitrary Model Context Protocol (MCP) commands as a local subprocess. The vulnerability, tracked as CVE-2026-75149, is a code injection issue that affects Marimo versions prior to 0.23.15. It carries a CVSS v4 score of 8.7 and a CVSS v3.1 score of 8.8, requiring user interaction but no attacker authentication.

The exploit mechanism involves an attacker crafting a malicious notebook. This notebook contains an attacker-controlled MCP server command embedded within its configuration. When a victim opens this notebook in edit mode, the specified command is launched as a local subprocess before any notebook cell is executed. This pre-execution command execution bypasses typical security checks that would occur during cell execution.

Marimo has patched this vulnerability in version 0.23.15, released on July 23, 2026. The fix involves hardening the notebook's metadata handling, treating notebook-supplied configuration as potentially attacker-controlled. Specifically, Marimo's PEP 723 hardening patch removes sensitive configuration sections such as 'ai', 'mcp', 'completion', 'secrets', and 'server' from being processed directly from notebook metadata.

This vulnerability is distinct from two other previously disclosed flaws in Marimo. CVE-2026-67618, disclosed on August 4, 2026, also affected versions prior to 0.23.15 and involved an attacker-controlled AI base_url supplied through notebook metadata, which could lead to an operator's API key being sent to a configured endpoint without cell execution. Another earlier flaw, CVE-2026-39987, affected versions 0.20.4 and earlier, allowing arbitrary command execution via a missing authentication validation on the /terminal/ws endpoint, granting a full pseudo-terminal (PTY) shell.

The discovery of CVE-2026-75149 is credited to Gregory Tan, also known as Grg0rry, who is also listed as a co-author on Marimo's PEP 723 hardening commit, indicating a close involvement in both the vulnerability's discovery and its remediation.

Marimo's security policy emphasizes the importance of staying current with the latest stable release. The current PyPI release is version 0.24.0, released on August 17, 2026, which includes the fix for this critical vulnerability. Users are strongly encouraged to update to a version outside the affected range to protect their systems from potential exploitation.

The implications of this vulnerability highlight the ongoing security challenges in development environments, particularly those involving complex configurations and external integrations. The ability to execute commands before code runs in a notebook environment poses a significant risk, potentially allowing attackers to compromise local systems, steal sensitive data, or establish a foothold for further malicious activity.