CVE-2026-39987

CVE-2026-39987 For Marimo 0.20.4 PoC ⚠️ This tool is intended for educational purposes and authorized security testing only. The creator is not responsible for any unauthorized or illegal use. Use at your own risk. ⚠️ Info: CVE-2026-39987 is a critical pre-authentication Remote Code Execution RCE...

CVE-2026-39987-POC

CVE-2026-39987 - Marimo 0.23.0 Pre-Auth RCE WebSocket Proof of Concept PoC exploit for a Critical Pre-Authentication Remote Code Execution RCE vulnerability in Marimo versions prior to 0.23.0. The vulnerability allows an unauthenticated attacker to connect to the WebSocket endpoint /terminal/ws a...

CVE-2026-39987

CVE-2026-39987 - marimo Terminal WebSocket Authentication Bypass poc Overview This repository contains CVE-2026-39987 affecting marimo versions before 0.23.0. The vulnerability exists in the terminal WebSocket endpoint, where insufficient authentication enforcement may allow an unauthenticated...

CVE-2026-39987

CVE-2026-39987 — Marimo Pre-Auth RCE /terminal/ws root@kitploit: CVSS 4.0 : 9.3 CRITICAL CVSS 3.x : 9.8 CRITICAL CWE : CWE-306 Missing Authentication for Critical Function Fix : Marimo 0.23.0+ Affects : Marimo Lab / authorized testing only HTB, CTF, engagement with written scope. Table of content...

CVE-2026-39987_exploit

🔥 CVE-2026-39987 | Marimo 预认证 RCE 漏洞利用 漏洞利用框架 | 完整远程代码执行（RCE） | WebSocket 认证绕过 🧠 了解命令详情 打开文件 website.html 🎯 概述 该漏洞利用针对在端口 2718（默认）上运行 WebSocket 的 Marimo 应用程序。该漏洞允许通过 WebSocket 认证绕过实现未授权命令执行 ，使攻击者获得完整的远程代码执行能力。 属性| 详情 ---|--- CVE ID| CVE-2026-39987 攻击向量| WebSocket 认证绕过 Shell 类型| 交互式 PTY（伪终端） 影响|...

CVE-2026-39987

CVE-2026-39987 — Marimo Python Notebook Pre-Authenticated Remote Code Execution TL;DR A pre-authenticated remote code execution vulnerability in Marimo , an open-source Python notebook for data science and AI/ML. The terminal WebSocket endpoint /terminal/ws completely skips authentication...

marimo_CVE-2026-39987_RCE_PoC

CVE-2026-39987 - Marimo This script is ONLY for educational purposes and authorized testing. Unauthorized use of this tool against systems without explicit permission is ILLEGAL. The author is not responsible for the misuse of this information. 📋 Description Marimo versions prior to 0.23.0 presen...

CVE-2026-39987-lab-or-marimo-cve-lab

CVE-2026-39987 Lab Guide Pre-Auth Remote Code Execution via Terminal WebSocket Authentication Bypass An educational Docker lab for understanding, reproducing, and patching this critical vulnerability in marimo. Table of Contents Overview Architecture Quick Start Step-by-Step Walkthrough Step 1:...

CVE-2026-39987

⚠️ CVE-2026-39987 — Unauthenticated Shell in marimo 0.23.0 A reactive Python notebook tool gave attackers a full shell in one WebSocket request. 📌 Overview CVE-2026-39987 is a critical pre-auth RCE vulnerability in marimo — a popular open-source reactive notebook for Python modern Jupyter...

CVE-2026-39987-Lab

CVE-2026-39987 — marimo Pre-Auth Terminal WebSocket RCE Lab Local-only Docker lab for reproducing and understanding CVE-2026-39987 in marimo. This project compares a vulnerable marimo service with a patched marimo service side-by-side, then demonstrates the difference using a least-harm proof...

CVE-2026-39987

CVE-2026-39987 — Marimo Pre-Auth RCE For educational and authorized security research purposes only. Description Pre-authenticated Remote Code Execution in Marimo = 0.20.4. The WebSocket endpoint /terminal/ws skips authentication validation, allowing an unauthenticated attacker to obtain a full...

CVE-2026-39987_PoC

CVE-2026-39987-PoC Disclaimer This script is for educational and authorized testing purposes ONLY. Unauthorized use of this tool against systems without explicit permission is ILLEGAL. The author is not responsible for any misuse of this information. Marimo versions prior to 0.23.0 have a critica...

CVE-2026-39987

CVE-2026-39987 — Marimo Pre-Auth RCE via Terminal WebSocket root@kitploit: / / | / / / | \ / \ \ / / | // / \ / / | | / / // // / / // // \ / Status: Patched in 0.23.0 — marimo-team/marimo@c24d480 Vulnerability The /terminal/ws endpoint lacks the validateauth call present in every other authe...

CVE-2026-39987-marimo-rce

CVE-2026-39987 - Marimo Pre-Auth RCE Unauthenticated Remote Code Execution in Marimo via WebSocket Terminal 📌 Overview CVE-2026-39987 is a critical Pre-Authentication Remote Code Execution vulnerability affecting Marimo versions prior to 0.23.0. The /terminal/ws WebSocket endpoint completely...

CVE-2026-39987-PoC

CVE-2026-39987 PoC 概述 Marimo = 0.20.4 受 /terminal/ws WebSocket 端点中一个预认证 RCE 漏洞的影响。 该端点会检查应用模式和终端支持情况，但在接受 WebSocket 连接之前不会验证身份认证 。随后它会创建一个 PTY shell，允许未认证的攻击者以 Marimo 进程的权限执行命令。 根本原因 与其他调用 validateauth 的 WebSocket 端点不同，易受攻击的终端端点直接接受连接： root@kitploit: if appstate.mode != SessionMode.EDIT: await...

CVE-2026-39987.py

CVE-2026-39987.py This python script exploit the vulnerable marimo /terminal/ws endpoint and returns a interactive shell. HOW TO USE : The only change it has to be made is to the change the HOST variable in the script. After changing the HOST variable execute the script in your Terminal like the...

CVE-2026-39987

CVE-2026-39987 Exploit POC Overview This repository contains a Proof-of-Concept POC script for CVE-2026-39987, a pre-authentication Remote Code Execution RCE vulnerability in Marimo. The exploit leverages a WebSocket endpoint to execute arbitrary commands on the target system. Vulnerability Detai...

CVE-2026-39987

CVE-2026-39987 marimo 是一个响应式 Python 笔记本。在 0.23.0 之前，Marimo 存在一个预认证 RCE 漏洞 root@kitploit: / | |// / / / / / / |/ |/ \ / | | | \ /| | /| //|/|/ / | | | / -----/ | |/ |/ ----- \ | |/ \ / / / / //// / | |// CVE-2026-39987 Marimo /terminal/ws — 未认证 WebSocket 预认证 RCE 批量扫描器 · 全面枚举 · 智能检测 作者：...

cohort-htb

Cohort — HTB writeup & exploit chain Machine Cohort HackTheBox. Full kill chain: 1. SSRF in the Flask API /api/validate → internal vhost discovery 2. Pre-auth RCE in Marimo 0.20.4 WebSocket terminal CVE-2026-39987 → shell as marimo 3. Privilege escalation via PackageKit 1.2.8 D-Bus TOCTOU...

CVE-2026-39987_POC

PoC — CVE-2026-39987 · Marimo Pre-Auth RCE CVSS 4.0: 9.3 Critical · AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H Affects: marimo 2 calls to validateauth. terminal.py - 0 @requires, 0 validateauth. -- the flaw. The AuthBackend middleware protects HTTP and the /ws websocket, but /terminal/ws accepts the...