Marimo Notebook RCE Flaw Lets Attackers Run MCP Commands Before Cells Execute

Marimo has patched a high-severity code injection vulnerability in its open-source notebook platform that allows a specially crafted notebook to execute attacker-supplied Model Context Protocol (MCP) commands as a local subprocess the moment a victim opens the file in edit mode—before any notebook cell is even evaluated. Tracked as CVE-2026-75149, the flaw affects Marimo releases prior to version 0.23.15 and carries a CVSS v4 score of 8.7 and a CVSS v3.1 score of 8.8. The vulnerability requires user interaction but no authentication, making it trivial to weaponize against developers and data scientists who routinely share or clone notebooks from untrusted sources. Discovered by researcher Gregory Tan (handle: Grg0rry), who also co-authored Marimo's PEP 723 hardening commit, the issue stems from the platform treating notebook metadata as trusted input rather than attacker-controlled data.

According to the VulnCheck CNA record and OSV's CVE import, an attacker can embed a malicious MCP server command directly inside the notebook's configuration block under sections such as "ai," "mcp," "completion," "secrets," or "server." When the victim opens the notebook in edit mode, the embedded command is launched as a local subprocess ahead of any cell execution. Marimo's remediation passes all notebook-supplied configuration through an allowlist, stripping these dangerous sections before they can be parsed. The regression test added with the patch specifically validates that an attacker-controlled MCP URL is rejected from the configuration. The Hacker News confirmed on August 25 that the current PyPI release is version 0.24.0 (shipped August 17), while the security fix shipped in 0.23.15 on July 23, 2026. Marimo's security policy emphasizes that patches are issued only for the latest stable release, urging users to stay current.

CVE-2026-75149 is not an isolated incident. The same configuration boundary was addressed in VulnCheck's separate CVE-2026-67618 advisory (CVSS 7.1), disclosed August 4, 2026, which allowed an attacker-controlled AI base_url to exfiltrate an operator's API key the moment an AI request was made—no cell execution required. Marimo had also previously disclosed CVE-2026-39987, a missing authentication flaw on the /terminal/ws endpoint affecting versions 0.20.4 and earlier that handed attackers a full PTY shell for arbitrary command execution. The pattern across all three CVEs is consistent: notebook metadata and platform endpoints were treated as trusted when they should have been treated as attacker-controlled surface area. Developers and ML practitioners running Marimo should immediately verify their installation, update to 0.23.15 or later, and audit any notebooks pulled from external repositories. Security teams can also use a port scanner to detect unexpected local listeners that a malicious subprocess might have spun up, and run a privacy checkup to review whether sensitive credentials or API keys may have been exposed during the window of exposure. For environments where notebooks are shared internally, enforcing signed or vetted notebook sources adds a critical second layer of defense against this class of supply-chain-style attack.