{"schema":"threatline.record/2","record":{"id":"CVE-2026-39987","aliases":["GHSA-2679-6mx9-h9xc","PYSEC-2026-407"],"summary":"Marimo Remote Code Execution Vulnerability","details":"Marimo contains an pre-authorization remote code execution vulnerability, allowing an unauthenticated attacked to shell access and execute arbitrary system commands.","categories":["Libraries & packages"],"product":"Marimo","vendor":"Marimo","ecosystem":"PyPI","affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-39987","source_modified_at":"2026-04-24T03:55:20.777Z","fetched_at":"2026-10-23T18:42:43.628194Z","product":"marimo","vendor":"marimo-team","versions":[{"version":"< 0.23.0","status":"affected"}],"defaultStatus":null},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-2679-6mx9-h9xc","source_modified_at":"2026-06-29T12:26:12.729455405Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"name":"marimo","ecosystem":"PyPI","purl":"pkg:pypi/marimo"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.23.0"}]}],"versions":["0.0.0","0.1.0","0.1.1","0.1.10","0.1.11","0.1.12","0.1.13","0.1.14","0.1.15","0.1.17","0.1.18","0.1.19","0.1.2","0.1.20","0.1.21","0.1.22","0.1.23","0.1.24","0.1.25","0.1.26","0.1.28","0.1.29","0.1.3","0.1.30","0.1.31","0.1.32","0.1.33","0.1.34","0.1.35","0.1.36","0.1.37","0.1.38","0.1.39","0.1.4","0.1.40","0.1.41","0.1.42","0.1.43","0.1.44","0.1.45","0.1.46","0.1.47","0.1.48","0.1.49","0.1.5","0.1.50","0.1.51","0.1.52","0.1.53","0.1.54"]}],"fixed_versions":[{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-2679-6mx9-h9xc","source_modified_at":"2026-06-29T12:26:12.729455405Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"name":"marimo","ecosystem":"PyPI","purl":"pkg:pypi/marimo"},"version":"0.23.0"}],"cvss":9.3,"severity":"Critical","kev":{"listed":true,"date_added":"2026-04-23","due_date":"2026-05-07","required_action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomware_campaign_use":"Unknown"},"epss":{"probability":0.37865,"percentile":0.98549,"score_date":"2026-10-23"},"published_at":"2026-04-09T17:16:55.639Z","modified_at":"2026-06-29T12:26:12.729455405Z","provenance":[{"source":"CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23T17:00:09.9001Z"},{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-39987","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-04-24T03:55:20.777Z"},{"source":"OSV","url":"https://osv.dev/vulnerability/GHSA-2679-6mx9-h9xc","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-06-29T12:26:12.729455405Z"},{"source":"Exploit-DB","url":"https://www.exploit-db.com/exploits/52673","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-09-02"},{"source":"Nuclei","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/javascript/cves/2026/CVE-2026-39987.yaml","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":null},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-39987","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["CISA KEV","CVE List","OSV","Exploit-DB","Nuclei","EPSS"],"references":[{"source":"CVE List","url":"https://github.com/marimo-team/marimo/security/advisories/GHSA-2679-6mx9-h9xc","tags":["x_refsource_CONFIRM"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-39987","source":"CISA KEV"},{"source":"CVE List","url":"https://github.com/marimo-team/marimo/pull/9098","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/marimo-team/marimo/commit/c24d4806398f30be6b12acd6c60d1d7c68cfd12a","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://www.sysdig.com/blog/marimo-oss-python-notebook-rce-from-disclosure-to-exploitation-in-under-10-hours","tags":["third-party-advisory"]},{"source":"CVE List","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-39987","tags":["government-resource"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","ssvc":{"exploitation":"active","automatable":"yes","technical_impact":"total","assessed_at":"2026-04-23T00:00:00+00:00"},"exploits":[{"source":"Exploit-DB","kind":"Webapps exploit","name":"Marimo  0.20.4 - RCE","url":"https://www.exploit-db.com/exploits/52673","date":"2026-09-02","added":"2026-09-02","verified":false},{"source":"Nuclei","kind":"Scanner template","name":"Marimo <= 0.20.4 - Pre-Auth Terminal WebSocket RCE","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/javascript/cves/2026/CVE-2026-39987.yaml"}],"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"ecosystem","confidence":"heuristic","reviewed":false},"change_timestamp":"2026-06-29T12:26:12.729455405Z","content_hash":"4a2ed93f33534ad97d163615f1125a58fb772abed8e53e089456ec37842a5c7b"}}