CVE-2026-39987.py

CVE-2026-39987.py This python script exploit the vulnerable marimo /terminal/ws endpoint and returns a interactive shell. HOW TO USE : The only change it has to be made is to the change the HOST variable in the script. After changing the HOST variable execute the script in your Terminal like the...

Marimo 0.20.4 - RCE

Title: Marimo 0.20.4 - RCE Date: August 2nd, 2026 Exploit Author: Jason Bernier Vendor Homepage: https://marimo.io/ Software Link: https://github.com/marimo-team/marimo Version: str: """Send command to target and receive output""" try: if not conn: print"- No active connection" return ""...

Exploit for Missing Authentication for Critical Function in Coreweave Marimo

CVE-2026-39987.py This python script exploit the vulnerable ma...

aissemble-notebook-exporter (1.0.0.dev1719419214), click-clack (>=0.1.0, <=0.2.1) +14 more potentially affected by CVE-2026-39987 via marimo (>=0.3.12, <=0.21.1)

marimo PYPI version =0.3.12, =0.1.0, =0.1.2, =1.2.7rc0, =2024.10.29, =2025.8.0, =0.1.0, =0.1.14, =0.5.1 - swift-comet-pipeline 0.3.0 - topologyx 1.1.0 and more Source cves: CVE-2026-39987 Source advisory: OSV:PYSEC-2026-407...

Exploit for Missing Authentication for Critical Function in Coreweave Marimo

CVE-2026-39987 Lab Guide Pre-Auth Remote Code Execution v...

CVE-2026-39987 marimo Affected by Pre-Auth Remote Code Execution via Terminal WebSocket Authentication Bypass

marimo is a reactive Python notebook. Prior to 0.23.0, Marimo has a Pre-Auth RCE vulnerability. The terminal WebSocket endpoint /terminal/ws lacks authentication validation, allowing an unauthenticated attacker to obtain a full PTY shell and execute arbitrary system commands. Unlike other WebSock...

aissemble-notebook-exporter (1.0.0.dev1719419214), click-clack (>=0.1.0, <=0.2.1) +14 more potentially affected by CVE-2026-39987 via marimo (>=0.3.12, <=0.21.1)

marimo PYPI version =0.3.12, =0.1.0, =0.1.2, =1.2.7rc0, =2024.10.29, =2025.8.0, =0.1.0, =0.1.14, =0.5.1 - swift-comet-pipeline 0.3.0 - topologyx 1.1.0 and more Source cves: CVE-2026-39987 Source advisory: OSV:GHSA-2679-6MX9-H9XC...

aissemble-notebook-exporter (1.0.0.dev1719419214), click-clack (>=0.1.0, <=0.2.1) +14 more potentially affected by CVE-2026-39987 via marimo (>=0.3.12, <=0.21.1)

marimo PYPI version =0.3.12, =0.1.0, =0.1.2, =1.2.7rc0, =2024.10.29, =2025.8.0, =0.1.0, =0.1.14, =0.5.1 - swift-comet-pipeline 0.3.0 - topologyx 1.1.0 and more Source cves: CVE-2026-39987 Source advisory: SNYK:PYTHON-MARIMO-15954201...

aissemble-notebook-exporter (1.0.0.dev1719419214), click-clack (>=0.1.0, <=0.2.1) +14 more potentially affected by CVE-2026-39987 via marimo (>=0.3.12, <=0.21.1)

marimo PYPI version =0.3.12, =0.1.0, =0.1.2, =1.2.7rc0, =2024.10.29, =2025.8.0, =0.1.0, =0.1.14, =0.5.1 - swift-comet-pipeline 0.3.0 - topologyx 1.1.0 and more Source cves: CVE-2026-39987 Source advisory: GHSA-2679-6MX9-H9XC...