Skip to content

Marimo CVE-2026-75149: attacker-supplied MCP command runs before cells execute in edit mode

Summary

VulnCheck's CNA record (covered by The Hacker News, August 25, 2026; CVE published August 19, 2026) documents CVE-2026-75149, a high-severity code-injection flaw in marimo notebook software. A crafted notebook can supply an attacker-controlled MCP (Model Context Protocol) server command through notebook configuration; when the victim opens the notebook in edit mode, the command is launched as a local subprocess before any notebook cell executes. No attacker authentication is required, but user interaction (opening the malicious notebook in edit mode) is required. CVSS v4: 8.7; CVSS v3.1: 8.8. Fixed in marimo 0.23.15 (published July 23, 2026); the current PyPI release is 0.24.0 (August 17, 2026). The CVE credits Grg0rry (Gregory Tan), whose handle also co-authors marimo's PEP 723 hardening commit.

Tags

Vulnerability mechanics

  • Attack surface: notebook metadata/configuration. The PEP 723 inline-script metadata in a .py/notebook file is treated as attacker-controlled once the file is opened.
  • Injection point: the mcp configuration section of notebook metadata can specify a server command. marimo spawns that command as a local subprocess when the notebook is opened in edit mode — before any cell runs, so no cell-level review happens first.
  • Fix: marimo 0.23.15's PEP 723 hardening patch treats notebook metadata as attacker-controlled and allowlists notebook-supplied configuration, stripping the ai, mcp, completion, secrets, and server sections. The patch's MCP regression test uses an attacker-controlled URL and verifies the mcp section is removed.
  • Related same-boundary flaw: VulnCheck's CVE-2026-67618 (CVSS 7.1, disclosed August 4, 2026, also fixed in 0.23.15) lets an attacker control the AI base_url through notebook metadata; an operator opening the malicious notebook later triggers exfiltration when the AI feature is used. Both flaws share the notebook-metadata configuration boundary.
  • Affected versions: marimo before 0.23.15. Patched: 0.23.15 (July 23, 2026) and later; current release 0.24.0 (August 17, 2026).

Defender heuristics

  1. Pin the version: any marimo install before 0.23.15 is exposed to both CVE-2026-75149 and CVE-2026-67618; move to ≥0.23.15 (0.24.0 is the current PyPI release as of August 25, 2026).
  2. Treat notebook files as untrusted input the same way as remote code: opening a notebook in edit mode executes attacker-chosen configuration before cell review — apply the same trust gate used for executing unreviewed scripts.
  3. Monitor for unexpected local-subprocess spawns from the marimo runtime process (python -m marimo / marimo kernel) on developer laptops and notebook servers, especially immediately after a notebook is opened in edit mode.
  4. Hunt the MCP config shape in shared/internal notebook repositories: mcp sections pointing at remote URLs or local commands inside notebook metadata are the pre-0.23.15 attack primitive.
  5. Scope lateral risk: marimo is often internet-reachable in dev environments; combine this with the existing marimo CVE-2026-39987 exploitation reporting (see related pages) when reviewing exposed notebook hosts.

Sources