CVE-2026-39987_exploit

🔥 CVE-2026-39987 | Marimo 预认证 RCE 漏洞利用 漏洞利用框架 | 完整远程代码执行（RCE） | WebSocket 认证绕过 🧠 了解命令详情 打开文件 website.html 🎯 概述 该漏洞利用针对在端口 2718（默认）上运行 WebSocket 的 Marimo 应用程序。该漏洞允许通过 WebSocket 认证绕过实现未授权命令执行 ，使攻击者获得完整的远程代码执行能力。 属性| 详情 ---|--- CVE ID| CVE-2026-39987 攻击向量| WebSocket 认证绕过 Shell 类型| 交互式 PTY（伪终端） 影响|...

CVE-2026-39987

CVE-2026-39987 — Ejecución Remota de Código Pre-Autenticada en Marimo Python Notebook TL;DR Una vulnerabilidad de ejecución remota de código pre-autenticada en Marimo , un notebook Python de código abierto para ciencia de datos e IA/ML. El endpoint WebSocket de terminal /terminal/ws omite por...

CVE-2026-39987

CVE-2026-39987 — Marimo 预认证远程代码执行 仅供教育和授权安全研究使用。 描述 Marimo = 0.20.4 中存在预认证远程代码执行漏洞。 WebSocket 端点 /terminal/ws 跳过了身份验证校验，允许未认证的攻击者通过单次连接获得完整的交互式 PTY shell。 CVSS v4.0： 9.3（严重） CWE： CWE-306（关键功能缺少身份验证） 受影响版本： = 0.20.4 修复版本： 0.23.0 环境要求 Python 3 websockets（pip install websockets） 可访问目标上的 2718 端口 端点验证...

CVE-2026-39987-PoC

CVE-2026-39987 PoC 概述 Marimo = 0.20.4 受 /terminal/ws WebSocket 端点中一个预认证 RCE 漏洞的影响。 该端点会检查应用模式和终端支持情况，但在接受 WebSocket 连接之前不会验证身份认证 。随后它会创建一个 PTY shell，允许未认证的攻击者以 Marimo 进程的权限执行命令。 根本原因 与其他调用 validateauth 的 WebSocket 端点不同，易受攻击的终端端点直接接受连接： if appstate.mode != SessionMode.EDIT: await websocket.close...

Heroinn

Heroinn 一个由 Rust 实现的跨平台 C2/后渗透框架。 本项目仅供研究学习使用，任何使用本项目的非法行为与本项目无关。 功能特性 图形界面 交互式 PTY shell 系统信息收集 文件管理器支持断点续传和大文件 支持 Win10+（Windows Server 2019+）及 Linux 和 BSD 和 OSX 多种通信协议（TCP 和 HTTP 和可靠 UDP） 待办事项 文档 如何编译 使用方法 反向 socks5 代理支持 shellcode 将 stage（.so/.dll）转换为 shellcode 加载器（无 stage） 加载器生成器 穿越防火墙 HTTP...

CVE-2026-39987

CVE-2026-39987 — Marimo 预认证 RCE（/terminal/ws） CVSS 4.0 : 9.3 CRITICAL CVSS 3.x : 9.8 CRITICAL CWE : CWE-306 Missing Authentication for Critical Function Fix : Marimo 0.23.0+ Affects : Marimo 仅限实验室/授权测试（HTB、CTF、有书面授权范围的测试项目）。 目录 漏洞概述 根本原因 攻击链 受影响版本 本仓库 安装 使用方法 Penelope 集成 修复建议 参考资料 漏洞概述 Marimo 通过...

CVE-2026-39987

CVE-2026-39987 — Marimo 通过终端 WebSocket 实现未认证 RCE / / | / / / | \ / \ \ / / | // / \ / / | | / / // // / / // // \ / 状态： 已在 0.23.0 中修复 — marimo-team/marimo@c24d480 漏洞 /terminal/ws 端点缺少其他所有已认证端点中存在的 validateauth 调用： ❌ /terminal/ws — 无认证检查（存在漏洞） @router.websocket"/ws" async def...

UBUNTU-CVE-2026-91838

A flaw was found in NetworkManager-sstp, the SSTP VPN plugin for NetworkManager. A local unprivileged user can exploit this vulnerability by embedding special characters, known as shell metacharacters, into VPN connection profile fields such as CA certificate or proxy settings. These unescaped...

CVE-2026-91838

A flaw was found in NetworkManager-sstp, the SSTP VPN plugin for NetworkManager. A local unprivileged user can exploit this vulnerability by embedding special characters, known as shell metacharacters, into VPN connection profile fields such as CA certificate or proxy settings. These unescaped...

Exploit for Missing Authentication for Critical Function in Coreweave Marimo

CVE-2026-39987 PoC Summary Marimo = 0.20.4 is affected...

CVE-2026-86121 Cua computer-server before 0.3.42 Unauthenticated RCE via Desktop Control

Cua computer-server versions before 0.3.42 skip authentication when the CONTAINERNAME environment variable is unset and bind to all interfaces by default, allowing unauthenticated attackers to execute arbitrary commands. Attackers can reach TCP port 8000 to run shell commands via the runcommand...

EUVD-2026-71953

Cua computer-server versions before 0.3.42 skip authentication when the CONTAINERNAME environment variable is unset and bind to all interfaces by default, allowing unauthenticated attackers to execute arbitrary commands. Attackers can reach TCP port 8000 to run shell commands via the runcommand...

Exploit for Missing Authentication for Critical Function in Coreweave Marimo

CVE-2026-39987 — Marimo Pre-Auth RCE via Terminal WebSocket...

MAL-2026-13428 Malicious code in @love-moon/conductor-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7ea5d4f1af0a0b67e6f74bfb45867ce0b33136083138e3c23a56df03d8b5c902 The conductor daemon command bin/conductor-daemon.js - src/daemon.js opens a WebSocket to https://conductor.conductor-ai.top or a user-configured...

MAL-2026-10720 Malicious code in @vibelet/cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3f3dc6503f9f63413994c6d0b2e19f22ebcf17f5e7ba9f713ce26ecf69c92c6c The @vibelet/cli package ships a daemon bundle dist/index.cjs, invoked by the vibelet bin and by vibelet start/restart/reset that starts an...

EUVD-2026-42722

Hermes WebUI before 0.51.788 contains an unauthenticated remote code execution vulnerability that allows remote attackers to execute arbitrary shell commands by accessing the embedded terminal API endpoints without credentials. Attackers can create a session, attach a PTY shell, and write arbitra...

CVE-2026-39987

marimo is a reactive Python notebook. Prior to 0.23.0, Marimo has a Pre-Auth RCE vulnerability. The terminal WebSocket endpoint /terminal/ws lacks authentication validation, allowing an unauthenticated attacker to obtain a full PTY shell and execute arbitrary system commands. Unlike other WebSock...

CVE-2026-39987

marimo is a reactive Python notebook. Prior to 0.23.0, Marimo has a Pre-Auth RCE vulnerability. The terminal WebSocket endpoint /terminal/ws lacks authentication validation, allowing an unauthenticated attacker to obtain a full PTY shell and execute arbitrary system commands. Unlike other WebSock...

EUVD-2026-20980

marimo is a reactive Python notebook. Prior to 0.23.0, Marimo has a Pre-Auth RCE vulnerability. The terminal WebSocket endpoint /terminal/ws lacks authentication validation, allowing an unauthenticated attacker to obtain a full PTY shell and execute arbitrary system commands. Unlike other WebSock...

CVE-2026-39987

CVE-2026-39987 — Marimo WebSocket terminal endpoint unauthenticated pre-auth RCE. The vulnerability resides in the terminal WebSocket at /terminal/ws, which accepts connections without authenticating, unlike the /ws endpoint that invokes validate_auth(). An unauthenticated client can obtain a ful...