Description
marimo is a reactive Python notebook. Prior to 0.23.0, Marimo has a Pre-Auth RCE vulnerability. The terminal WebSocket endpoint /terminal/ws lacks authentication validation, allowing an unauthenticated attacker to obtain a full PTY shell and execute arbitrary system commands. Unlike other WebSocket endpoints (e.g., /ws) that correctly call validate_auth() for authentication, the /terminal/ws endpoint only checks the running mode and platform support before accepting connections, completely skipping authentication verification. This vulnerability is fixed in 0.23.0.
INFO
Published Date :
2026-04-09T17:16:55.639Z
Last Modified :
2026-04-09T17:44:29.019Z
Source :
GitHub_M
AFFECTED PRODUCTS
The following products are affected by CVE-2026-39987 vulnerability.
| Vendors | Products |
|---|---|
| Marimo-team |
|
REFERENCES
Here, you will find a curated list of external links that provide in-depth information to CVE-2026-39987.
