CVE-2026-39987
Marimo Remote Code Execution Vulnerability
Description
CVE-2026-39987 is a critical pre-authentication remote code execution vulnerability in Marimo, an open-source reactive Python notebook environment developed by Marimo Inc. and widely used in data science, machine learning research, and collaborative analytics workflows. The vulnerability allows completely unauthenticated attackers to achieve arbitrary OS command execution on the host running the Marimo server by exploiting an OS command injection flaw (CWE-78), providing direct shell access without any credential requirements. Marimo notebooks are frequently deployed in internal data science environments, Jupyter-alternative setups, and increasingly on shared organizational infrastructure or internet-exposed servers for collaborative work — any such exposure creates a trivially exploitable attack surface via CVE-2026-39987. A successful exploit gives the attacker a shell running as the OS user executing the Marimo server process, which in data science environments is often a high-privilege user with access to training datasets, model weights, API keys, cloud credentials, and proprietary research data. CISA added CVE-2026-39987 to the Known Exploited Vulnerabilities (KEV) catalog on 2026-04-23, with a remediation due date of 2026-05-07, confirming active exploitation in the wild. The EPSS score is 0.06989, placing this in the 91.5th percentile — significantly elevated, indicating observed exploitation attempts across the threat intelligence sensor network. No ransomware campaigns have been specifically attributed to this CVE at time of publication.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| coreweave | marimo | < 0.23.0 |
References
- https://github.com/marimo-team/marimo/commit/c24d4806398f30be6b12acd6c60d1d7c68cfd12a(Patch)
- https://github.com/marimo-team/marimo/pull/9098(Issue Tracking, Patch)
- https://github.com/marimo-team/marimo/security/advisories/GHSA-2679-6mx9-h9xc(Exploit, Mitigation, Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-39987(US Government Resource)
- https://www.sysdig.com/blog/marimo-oss-python-notebook-rce-from-disclosure-to-exploitation-in-under-10-hours(Exploit, Third Party Advisory)
Weakness Type
CWE-78: Improper Neutralization of Special Elements Used in an OS Command (OS Command Injection)
CWE-78, commonly known as OS Command Injection, occurs when an application constructs all or part of an operating system command using externally influenced input — such as HTTP request parameters, notebook cell input, file paths, or configuration values — without adequately sanitizing or escaping characters that have special meaning to the underlying shell interpreter. When the crafted input reaches a function that invokes a system shell (e.g., Python's os.system(), subprocess.call(shell=True), or similar), the attacker-controlled characters (semicolons, pipe operators, backticks, dollar signs, newlines) are interpreted as command delimiters or expansions, causing the shell to execute attacker-supplied commands in addition to or instead of the intended command. In CVE-2026-39987, this injection occurs at the pre-authentication level — the vulnerable code path is reachable before any user identity check, meaning no account is needed to trigger the injection.
OS command injection vulnerabilities in Python-based data science tooling carry particularly high-impact consequences because Python notebook environments typically execute with the full privileges of the user who launched the server, often in environments with direct access to sensitive data pipelines, ML model training infrastructure, cloud provider credential files (AWS ~/.aws/credentials, GCP application-default credentials, Azure CLI tokens), and Git repositories containing proprietary code. Unlike traditional web application command injection where the server may be a restricted web user, notebook servers are frequently run by data scientists or ML engineers with broad filesystem and cloud access. Additionally, Marimo's reactive notebook model means the server process maintains persistent state, providing attackers with a stable, long-running shell environment rather than a one-shot command execution context.
Learn more: CWE-78 — Improper Neutralization of Special Elements Used in an OS Command
Impact Analysis
The attack vector is Network — CVE-2026-39987 is exploitable over any network connection that can reach the Marimo server's HTTP interface, which defaults to port 2718. Marimo instances in data science environments are frequently exposed on internal networks without authentication (the default Marimo configuration does not require login), and some deployments are inadvertently exposed to the internet via misconfigured cloud security groups, port forwarding, or ngrok-style tunnels used by data scientists for remote collaboration. Attack Complexity is Low — the command injection requires no special preconditions, no knowledge of application state, and no timing sensitivity. Privileges Required is None — the vulnerability is pre-authentication, making this a zero-click, zero-credential RCE. User Interaction is None.
The scope of impact extends beyond the Marimo process itself to the entire host system and potentially to connected infrastructure. Confidentiality impact is High: the attacker gains shell access to the host, enabling reading of all files accessible to the Marimo process user — including cloud provider credential files, SSH private keys, environment variables containing API tokens, Jupyter/Marimo notebook files with embedded data, ML model weights and training data, and any secrets in the working directory or Python path. Integrity impact is High: the attacker can modify notebooks, plant backdoored code in shared repositories, alter training data (model poisoning), insert malicious scripts into the data pipeline, and establish persistent access via crontab, SSH authorized keys, or modified Python packages. Availability impact is High: the attacker can terminate the Marimo server, corrupt training runs, delete datasets, or use the host as a pivot point for further attacks into internal networks.
The data science context amplifies all CIA impacts: cloud credentials found on notebook servers frequently have broad S3, GCS, or Azure Blob Storage access (to training data buckets), broad compute permissions (for launching GPU instances), and sometimes organizational admin-level API keys for ML platform services. A successful exploit is not just host compromise but a potential entry point into the entire cloud data infrastructure.
Exploit Maturity
CVE-2026-39987 is confirmed as actively exploited in the wild, with CISA adding it to the KEV catalog on 2026-04-23 with a remediation due date of 2026-05-07. The EPSS score of 0.06989 places it in the 91.5th percentile — the top ~8.5% of all CVEs by exploitation probability — reflecting observed exploitation attempts in threat intelligence sensor networks at a rate significantly above baseline.
The pre-authentication RCE nature of this vulnerability — combined with Marimo's typical deployment without mandatory authentication — makes it highly attractive to automated exploitation tooling. Opportunistic scanners and botnet operators routinely probe for known notebook server ports (Jupyter's 8888, Marimo's 2718, similar) and can mass-exploit vulnerable instances without any target-specific knowledge. The 91.5th percentile EPSS score is consistent with this kind of broad automated scanning activity.
No specific named ransomware groups or APT actors have been publicly attributed to CVE-2026-39987 exploitation at time of publication. However, pre-authentication RCE vulnerabilities with shell access in data science infrastructure are attractive to multiple threat actor classes: opportunistic cryptominers who exploit notebook servers to mine cryptocurrency using victim compute resources (a well-documented threat to Jupyter and notebook infrastructure since 2019), data exfiltration actors seeking ML model IP and training data, and supply chain attackers who can use notebook server access to poison shared data pipelines or model repositories. The speed of KEV listing relative to CVE disclosure suggests exploitation was observed quickly after the vulnerability became known, consistent with automated scanning by prepared threat actors.
Remediation
-
CISA KEV Directive Compliance: Federal civilian executive branch agencies must remediate CVE-2026-39987 by 2026-05-07 per BOD 22-01. The 91.5th percentile EPSS score and confirmed active exploitation make equivalent urgency appropriate for all organizations. Inventory all Marimo server instances across the environment immediately — including ad-hoc developer deployments that may not be tracked in asset management systems.
-
Update Marimo to the Patched Version: Upgrade Marimo to the version that resolves CVE-2026-39987 as specified in the Marimo security advisory (github.com/marimo-team/marimo/security/advisories). Marimo is distributed via PyPI and can be updated with
pip install --upgrade marimooruv add marimo --upgradedepending on the project's package management. For conda environments, useconda update marimoif available in the configured channels. Verify the installed version withmarimo --versionafter upgrade. -
Interim Mitigations: If immediate patching is not possible, shut down all Marimo server instances that are not strictly required. For instances that must remain operational, immediately restrict network access to the Marimo port (default: 2718) to only trusted IP addresses using host-based firewall rules (
ufw,iptables,nftables) or network security groups. Place the Marimo server behind an authenticated reverse proxy (nginx withauth_basicor OAuth2 Proxy) that requires authentication before any request reaches Marimo. -
Network and Access Controls: Audit all firewall rules and cloud security group configurations for Marimo server ports. Any Marimo instance reachable from the internet without authentication should be considered compromised and treated as an active incident. Enforce the rule that notebook servers must never be directly internet-exposed — require VPN or bastion host access as a prerequisite. Apply network segmentation so that Marimo hosts can only reach the specific cloud storage endpoints and compute resources required for their notebooks, not broad internal networks.
-
Detection and Incident Investigation: Review OS-level process execution logs on Marimo hosts for unexpected child processes spawned by the Marimo server process. Look for shell invocations (
/bin/sh,/bin/bash) with suspicious arguments, network connections to external IP addresses, and file creation events in sensitive directories (~/.ssh, ~/.aws, /etc/cron.d). Given the KEV confirmation of active exploitation, any organization running Marimo should check for unauthorized SSH authorized_keys entries, new crontab entries, unexpected Python packages installed via pip, and modified notebook files. Run a full file integrity check if the server was publicly accessible during the vulnerability window. -
Defense-in-Depth Against CWE-78: Run Marimo servers as a dedicated, minimal-privilege service account with no cloud credential files in its home directory — pass cloud credentials via instance metadata or environment variables scoped to specific required resources only. Use OS-level sandboxing (systemd service with
NoNewPrivileges=yes,PrivateTmp=yes,ReadOnlyPaths=/with explicitReadWritePathsexceptions) to limit the impact of any command injection. Implement outbound network restrictions on Marimo hosts to prevent attacker exfiltration channels. Store API keys and cloud credentials in a secrets manager (AWS Secrets Manager, HashiCorp Vault) and inject them at runtime rather than persisting them in files accessible to the notebook server process.
Technical Details
CVE-2026-39987 is an OS command injection vulnerability (CWE-78) in Marimo's server-side Python code. Marimo is a reactive Python notebook that re-runs notebook cells as a reactive graph when inputs change, and its server component handles HTTP requests from the browser-based frontend to execute Python code and manage the notebook session. The vulnerability exists in a code path that processes attacker-controlled input — likely a request parameter, notebook name, file path, or configuration value — and passes it to a system shell invocation without adequate sanitization.
The pre-authentication nature of the vulnerability indicates that the vulnerable code path is triggered before Marimo's session authentication checks (if any are configured), or that the specific endpoint is intended to be publicly accessible (e.g., a health check, a static file server, or an initial session setup endpoint) but fails to sanitize input that reaches a shell command. Python's os.system(), subprocess.call(shell=True), subprocess.Popen(shell=True), and shlex-bypassing patterns are common sources of CWE-78 in Python applications. The use of shell=True in subprocess calls is particularly dangerous as it passes the entire command string to /bin/sh -c, allowing shell metacharacters in attacker-controlled input to inject additional commands.
Marimo's default server configuration on port 2718 starts without mandatory authentication, relying on the assumption that it is run on localhost or in a trusted network environment. This design assumption — common across the Jupyter ecosystem and its alternatives — creates a systemic risk when notebook servers are inadvertently exposed. CVE-2026-39987 shows that even the "run locally and trust the network" assumption is invalid when the application itself executes attacker-supplied shell commands without authentication.
The Marimo security advisory and associated GitHub commit diff for the fix provide the specific vulnerable code path, affected versions, and the remediation approach (input sanitization, removal of shell=True, or use of command argument arrays instead of shell strings). Consult github.com/marimo-team/marimo/security/advisories for the authoritative technical details.
Frequently Asked Questions
Is CVE-2026-39987 being actively exploited?
Yes. CISA confirmed active exploitation by adding CVE-2026-39987 to the KEV catalog on 2026-04-23. The 91.5th percentile EPSS score indicates widespread exploitation attempts are being captured in threat intelligence feeds. Pre-authentication RCE vulnerabilities in notebook servers are a known high-value target for both automated botnet operators (cryptomining) and targeted actors (data exfiltration, supply chain poisoning).
What products are affected?
Marimo, the open-source reactive Python notebook environment (github.com/marimo-team/marimo, distributed via PyPI as the marimo package), is affected in versions prior to the patched release. The affected versions are specified in Marimo's security advisory on the GitHub Security Advisories page. Organizations should inventory all Marimo installations across developer workstations, shared servers, cloud-hosted notebook environments, and CI/CD pipelines that use Marimo for notebook-driven automation.
How do I fix it?
Update Marimo to the patched version using pip install --upgrade marimo or the equivalent command for your package manager. The patched version is specified in Marimo's security advisory. As an interim measure while patching is arranged, shut down all unnecessary Marimo server instances and restrict network access to the Marimo port (default 2718) to trusted IP addresses only. Place any required Marimo instances behind an authenticated reverse proxy that requires login before requests reach the Marimo application.
How severe is it?
CVE-2026-39987 is Critical. An unauthenticated attacker with network access to the Marimo server can execute arbitrary OS commands and obtain a shell on the host without any credentials or prior knowledge. In data science environments, this typically means immediate access to cloud provider credentials, API keys, ML training data, model weights, and proprietary code. The confirmed KEV listing and 91.5th percentile EPSS make this a P0 immediate remediation item for any organization running Marimo.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.