All vulnerabilities
CVE-2026-39987GHSA-2679-6mx9-h9xcPYSEC-2026-407

Marimo Remote Code Execution Vulnerability

Marimo MarimoPyPILibraries & packages
Open in ThreatlineRecord JSON
CVSS
9.3Critical
ExploitationExploited in the wildAdded to KEV 23 Apr 2026CISA KEV
Exploit odds (EPSS)37.9%Chance of exploitation activity in the next 30 days, higher than 98% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in0.23.0Fixed versionOSV
Federal deadline7 May 2026Remediation due date for US federal agenciesCISA KEV
CISA required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. CISA KEV

What fixes it

  • 0.23.0marimo, PyPIOSVpip install "marimo>=0.23.0"

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Timeline

  1. 9 Apr 2026, 17:16 UTCPublishedCVE List
  2. 23 Apr 2026Added to CISA KEVCISA KEV
  3. 2 Sep 2026Exploit code publicExploit-DB

Public exploit code and templates 2

  • Webapps exploitMarimo 0.20.4 - RCE 2 Sep 2026Exploit-DB
  • Scanner templateMarimo <= 0.20.4 - Pre-Auth Terminal WebSocket RCENuclei

Listed so defenders can prioritize. Threatline links to the source and does not host exploit code.

Reports 1

1 outlet mention it. Reports are not confirmation; each links to its source.

Description

Marimo contains an pre-authorization remote code execution vulnerability, allowing an unauthenticated attacked to shell access and execute arbitrary system commands.

Text from CVE List

Affected versions 52

  • marimoaffected: < 0.23.0CVE List
  • marimo, PyPIfrom first release, fixed in 0.23.0OSV
  • marimo, PyPI0.0.0OSV
  • marimo, PyPI0.1.0OSV
  • marimo, PyPI0.1.1OSV
  • marimo, PyPI0.1.10OSV
  • marimo, PyPI0.1.11OSV
  • marimo, PyPI0.1.12OSV
  • marimo, PyPI0.1.13OSV
  • marimo, PyPI0.1.14OSV
  • marimo, PyPI0.1.15OSV
  • marimo, PyPI0.1.17OSV
  • marimo, PyPI0.1.18OSV
  • marimo, PyPI0.1.19OSV
  • marimo, PyPI0.1.2OSV
  • marimo, PyPI0.1.20OSV
  • marimo, PyPI0.1.21OSV
  • marimo, PyPI0.1.22OSV
  • marimo, PyPI0.1.23OSV
  • marimo, PyPI0.1.24OSV
  • marimo, PyPI0.1.25OSV
  • marimo, PyPI0.1.26OSV
  • marimo, PyPI0.1.28OSV
  • marimo, PyPI0.1.29OSV
  • marimo, PyPI0.1.3OSV
  • marimo, PyPI0.1.30OSV
  • marimo, PyPI0.1.31OSV
  • marimo, PyPI0.1.32OSV
  • marimo, PyPI0.1.33OSV
  • marimo, PyPI0.1.34OSV
  • marimo, PyPI0.1.35OSV
  • marimo, PyPI0.1.36OSV
  • marimo, PyPI0.1.37OSV
  • marimo, PyPI0.1.38OSV
  • marimo, PyPI0.1.39OSV
  • marimo, PyPI0.1.4OSV
  • marimo, PyPI0.1.40OSV
  • marimo, PyPI0.1.41OSV
  • marimo, PyPI0.1.42OSV
  • marimo, PyPI0.1.43OSV
  • marimo, PyPI0.1.44OSV
  • marimo, PyPI0.1.45OSV
  • marimo, PyPI0.1.46OSV
  • marimo, PyPI0.1.47OSV
  • marimo, PyPI0.1.48OSV
  • marimo, PyPI0.1.49OSV
  • marimo, PyPI0.1.5OSV
  • marimo, PyPI0.1.50OSV
  • marimo, PyPI0.1.51OSV
  • marimo, PyPI0.1.52OSV
  • marimo, PyPI0.1.53OSV
  • marimo, PyPI0.1.54OSV

References 6