CVE-2026-39987

CVE-2026-39987 — Marimo 通过终端 WebSocket 实现未认证 RCE / / | / / / | \ / \ \ / / | // / \ / / | | / / // // / / // // \ / 状态： 已在 0.23.0 中修复 — marimo-team/marimo@c24d480 漏洞 /terminal/ws 端点缺少其他所有已认证端点中存在的 validateauth 调用： ❌ /terminal/ws — 无认证检查（存在漏洞） @router.websocket"/ws" async def...

CVE-2026-39987

CVE-2026-39987 — Marimo Python 笔记本未认证远程代码执行 TL;DR Marimo （一个用于数据科学和 AI/ML 的开源 Python 笔记本）中存在一个未认证远程代码执行 漏洞。终端 WebSocket 端点（/terminal/ws）完全跳过了身份验证检查 ，而相邻的笔记本端点（/ws）则正确执行了该检查。未认证的攻击者可以连接到 /terminal/ws，在零凭据的情况下获得主机系统上的完整交互式 PTY shell 。 该漏洞在披露后 10 小时内 即被在野利用。攻击者在不到 3 分钟内窃取了 AWS 凭据。 影响 Marimo =...

CVE-2026-39987

⚠️ CVE-2026-39987 — marimo =0.23.0" 官方公告 ： GHSA-267...

CVE-2026-39987-marimo-rce

CVE-2026-39987 - Marimo 预认证远程代码执行 在 Marimo 中通过 WebSocket 终端实现未认证远程代码执行 📌 概述 CVE-2026-39987 是一个影响 Marimo 0.23.0 之前版本的严重预认证远程代码执行 漏洞。/terminal/ws WebSocket 端点完全绕过认证，允许任何未认证的攻击者以 Marimo 进程的权限（在 Docker 环境中通常为 root ）获取完整的交互式 PTY shell。 🛠️ 漏洞详情 CVE ID : CVE-2026-39987 受影响产品 : Marimo（响应式 Python 笔记本） 受影响版...

CVE-2026-39987

CVE-2026-39987 - Marimo Pre-Authentication RCE CVE-2026-39987 is a critical pre-authentication Remote Code Execution RCE vulnerability affecting Marimo, a reactive Python notebook environment. The vulnerability exists in Marimo's terminal WebSocket endpoint: /terminal/ws The endpoint failed to...

CVE-2026-7810

A flaw has been found in UsamaK98 python-notebook-mcp up to a05a232815809a7e425b5fa7be26e0d4369894c2. Impacted is the function createnotebook/readnotebook/editcell/addcell of the file server.py. This manipulation causes path traversal. It is possible to initiate the attack remotely. The exploit h...

EUVD-2026-27211

A flaw has been found in UsamaK98 python-notebook-mcp up to a05a232815809a7e425b5fa7be26e0d4369894c2. Impacted is the function createnotebook/readnotebook/editcell/addcell of the file server.py. This manipulation causes path traversal. It is possible to initiate the attack remotely. The exploit h...

CVE-2026-7810

A flaw has been found in UsamaK98 python-notebook-mcp up to a05a232815809a7e425b5fa7be26e0d4369894c2. Impacted is the function createnotebook/readnotebook/editcell/addcell of the file server.py. This manipulation causes path traversal. It is possible to initiate the attack remotely. The exploit h...

CVE-2026-7810

A flaw has been found in UsamaK98 python-notebook-mcp up to a05a232815809a7e425b5fa7be26e0d4369894c2. Impacted is the function createnotebook/readnotebook/editcell/addcell of the file server.py. This manipulation causes path traversal. It is possible to initiate the attack remotely. The exploit h...

CVE-2026-7810 UsamaK98 python-notebook-mcp server.py add_cell path traversal

A flaw has been found in UsamaK98 python-notebook-mcp up to a05a232815809a7e425b5fa7be26e0d4369894c2. Impacted is the function createnotebook/readnotebook/editcell/addcell of the file server.py. This manipulation causes path traversal. It is possible to initiate the attack remotely. The exploit h...

CVE-2026-7810 UsamaK98 python-notebook-mcp server.py add_cell path traversal

A flaw has been found in UsamaK98 python-notebook-mcp up to a05a232815809a7e425b5fa7be26e0d4369894c2. Impacted is the function createnotebook/readnotebook/editcell/addcell of the file server.py. This manipulation causes path traversal. It is possible to initiate the attack remotely. The exploit h...

CVE-2026-7810: Improper Limitation of a Pathname to a Restricted Directory

A flaw has been found in UsamaK98 python-notebook-mcp up to a05a232815809a7e425b5fa7be26e0d4369894c2. Impacted is the function createnotebook/readnotebook/editcell/addcell of the file server.py. This manipulation causes path traversal. It is possible to initiate the attack remotely. The exploit h...

Python Notebook MCP 路径遍历漏洞

Python Notebook MCP is an interactive tool developed by Usama Khatab, allowing AI assistants to operate Jupyter notebooks. Python Notebook MCP has a path traversal vulnerability, which stems from issues with the functions createnotebook/readnotebook/editcell/addcell in the file server.py,...

Fedora: Security Advisory (FEDORA-2025-7472c8fb5c)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora 43 : jupyterlab / python-notebook (2025-7472c8fb5c)

The remote Fedora 43 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2025-7472c8fb5c advisory. New jupyterlab and notebook Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested...

Fedora 42 : jupyterlab / python-notebook (2025-ebcd1295c7)

The remote Fedora 42 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2025-ebcd1295c7 advisory. New jupyterlab and notebook Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested...

Fedora: Security Advisory (FEDORA-2024-4b5f3d51ca)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora: Security Advisory (FEDORA-2025-e15a193ad3)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora: Security Advisory (FEDORA-2024-d335b971e7)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora: Security Advisory (FEDORA-2025-ebcd1295c7)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...