CVE-2026-39987

CVE-2026-39987 — Marimo Pre-Auth RCE /terminal/ws root@kitploit: CVSS 4.0 : 9.3 CRITICAL CVSS 3.x : 9.8 CRITICAL CWE : CWE-306 Missing Authentication for Critical Function Fix : Marimo 0.23.0+ Affects : Marimo Lab / authorized testing only HTB, CTF, engagement with written scope. Table of content...

CVE-2026-39987_exploit

🔥 CVE-2026-39987 | Marimo 预认证 RCE 漏洞利用 漏洞利用框架 | 完整远程代码执行（RCE） | WebSocket 认证绕过 🧠 了解命令详情 打开文件 website.html 🎯 概述 该漏洞利用针对在端口 2718（默认）上运行 WebSocket 的 Marimo 应用程序。该漏洞允许通过 WebSocket 认证绕过实现未授权命令执行 ，使攻击者获得完整的远程代码执行能力。 属性| 详情 ---|--- CVE ID| CVE-2026-39987 攻击向量| WebSocket 认证绕过 Shell 类型| 交互式 PTY（伪终端） 影响|...

CVE-2026-39987

CVE-2026-39987 — Marimo Python Notebook Pre-Authenticated Remote Code Execution TL;DR A pre-authenticated remote code execution vulnerability in Marimo , an open-source Python notebook for data science and AI/ML. The terminal WebSocket endpoint /terminal/ws completely skips authentication...

CVE-2026-39987

CVE-2026-39987 — Marimo Pre-Auth RCE For educational and authorized security research purposes only. Description Pre-authenticated Remote Code Execution in Marimo = 0.20.4. The WebSocket endpoint /terminal/ws skips authentication validation, allowing an unauthenticated attacker to obtain a full...

CVE-2026-39987

CVE-2026-39987 — Marimo Pre-Auth RCE via Terminal WebSocket root@kitploit: / / | / / / | \ / \ \ / / | // / \ / / | | / / // // / / // // \ / Status: Patched in 0.23.0 — marimo-team/marimo@c24d480 Vulnerability The /terminal/ws endpoint lacks the validateauth call present in every other authe...

CVE-2026-39987-PoC

CVE-2026-39987 PoC 概述 Marimo = 0.20.4 受 /terminal/ws WebSocket 端点中一个预认证 RCE 漏洞的影响。 该端点会检查应用模式和终端支持情况，但在接受 WebSocket 连接之前不会验证身份认证 。随后它会创建一个 PTY shell，允许未认证的攻击者以 Marimo 进程的权限执行命令。 根本原因 与其他调用 validateauth 的 WebSocket 端点不同，易受攻击的终端端点直接接受连接： root@kitploit: if appstate.mode != SessionMode.EDIT: await...

Heroinn

Heroinn A cross platform C2/post-exploitation framework implementation by Rust. This project is for research and study purposes only, and any illegal behavior using this project has nothing to do with this project. Features GUI Interactive PTY shell System infomations collect File manager support...

CVE-2026-86121 Cua computer-server before 0.3.42 Unauthenticated RCE via Desktop Control

Cua computer-server versions before 0.3.42 skip authentication when the CONTAINERNAME environment variable is unset and bind to all interfaces by default, allowing unauthenticated attackers to execute arbitrary commands. Attackers can reach TCP port 8000 to run shell commands via the runcommand...

EUVD-2026-71953

Cua computer-server versions before 0.3.42 skip authentication when the CONTAINERNAME environment variable is unset and bind to all interfaces by default, allowing unauthenticated attackers to execute arbitrary commands. Attackers can reach TCP port 8000 to run shell commands via the runcommand...

MAL-2026-10720 Malicious code in @vibelet/cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3f3dc6503f9f63413994c6d0b2e19f22ebcf17f5e7ba9f713ce26ecf69c92c6c The @vibelet/cli package ships a daemon bundle dist/index.cjs, invoked by the vibelet bin and by vibelet start/restart/reset that starts an...

EUVD-2026-42722

Hermes WebUI before 0.51.788 contains an unauthenticated remote code execution vulnerability that allows remote attackers to execute arbitrary shell commands by accessing the embedded terminal API endpoints without credentials. Attackers can create a session, attach a PTY shell, and write arbitra...

CVE-2026-39987

marimo is a reactive Python notebook. Prior to 0.23.0, Marimo has a Pre-Auth RCE vulnerability. The terminal WebSocket endpoint /terminal/ws lacks authentication validation, allowing an unauthenticated attacker to obtain a full PTY shell and execute arbitrary system commands. Unlike other WebSock...

CVE-2026-39987

marimo is a reactive Python notebook. Prior to 0.23.0, Marimo has a Pre-Auth RCE vulnerability. The terminal WebSocket endpoint /terminal/ws lacks authentication validation, allowing an unauthenticated attacker to obtain a full PTY shell and execute arbitrary system commands. Unlike other WebSock...

CVE-2026-39987

CVE-2026-39987 — Marimo WebSocket terminal endpoint unauthenticated pre-auth RCE. The vulnerability resides in the terminal WebSocket at /terminal/ws, which accepts connections without authenticating, unlike the /ws endpoint that invokes validate_auth(). An unauthenticated client can obtain a ful...

EUVD-2026-20980

marimo is a reactive Python notebook. Prior to 0.23.0, Marimo has a Pre-Auth RCE vulnerability. The terminal WebSocket endpoint /terminal/ws lacks authentication validation, allowing an unauthenticated attacker to obtain a full PTY shell and execute arbitrary system commands. Unlike other WebSock...

marimo 访问控制错误漏洞

Marimo is an open-source interactive Python notebook that supports reactive programming and SQL queries. Versions of Marimo prior to 0.23.0 contained a access control vulnerability. This vulnerability stemmed from the lack of authentication for the terminal WebSocket endpoint, allowing...

VulnCheck KEV: CVE-2026-39987

marimo is a reactive Python notebook. Prior to 0.23.0, Marimo has a Pre-Auth RCE vulnerability. The terminal WebSocket endpoint /terminal/ws lacks authentication validation, allowing an unauthenticated attacker to obtain a full PTY shell and execute arbitrary system commands. Unlike other WebSock...

A Red Teamer’s guide to pivoting

A Red Teamer’s guide to pivoting A Red Teamer's guide to pivoting Penetration testers often traverse logical network boundaries in order to gain access to client’s critical infrastracture. Common scenarios include developing the attack into the internal network after successful perimeter breach o...