CVE-2026-39987

⚠️ CVE-2026-39987 — Unauthenticated Shell in marimo 0.23.0 A reactive Python notebook tool gave attackers a full shell in one WebSocket request. 📌 Overview CVE-2026-39987 is a critical pre-auth RCE vulnerability in marimo — a popular open-source reactive notebook for Python modern Jupyter...

CVE-2026-39987

CVE-2026-39987 — Marimo Pre-Auth RCE via Terminal WebSocket / / | / / / | \ / \ \ / / | // / \ / / | | / / // // / / // // \ / Status: Patched in 0.23.0 — marimo-team/marimo@c24d480 Vulnerability The /terminal/ws endpoint lacks the validateauth call present in every other authenticated endpoint...

CVE-2026-39987-marimo-rce

CVE-2026-39987 - Marimo Pre-Auth RCE Unauthenticated Remote Code Execution in Marimo via WebSocket Terminal 📌 Overview CVE-2026-39987 is a critical Pre-Authentication Remote Code Execution vulnerability affecting Marimo versions prior to 0.23.0. The /terminal/ws WebSocket endpoint completely...

CVE-2026-39987

CVE-2026-39987 — Marimo Python Notebook Pre-Authenticated Remote Code Execution TL;DR A pre-authenticated remote code execution vulnerability in Marimo , an open-source Python notebook for data science and AI/ML. The terminal WebSocket endpoint /terminal/ws completely skips authentication...

CVE-2026-39987

CVE-2026-39987 - Marimo Pre-Authentication RCE CVE-2026-39987 is a critical pre-authentication Remote Code Execution RCE vulnerability affecting Marimo, a reactive Python notebook environment. The vulnerability exists in Marimo's terminal WebSocket endpoint: /terminal/ws The endpoint failed to...

CVE-2026-7810

A flaw has been found in UsamaK98 python-notebook-mcp up to a05a232815809a7e425b5fa7be26e0d4369894c2. Impacted is the function createnotebook/readnotebook/editcell/addcell of the file server.py. This manipulation causes path traversal. It is possible to initiate the attack remotely. The exploit h...

EUVD-2026-27211

A flaw has been found in UsamaK98 python-notebook-mcp up to a05a232815809a7e425b5fa7be26e0d4369894c2. Impacted is the function createnotebook/readnotebook/editcell/addcell of the file server.py. This manipulation causes path traversal. It is possible to initiate the attack remotely. The exploit h...

CVE-2026-7810

A flaw has been found in UsamaK98 python-notebook-mcp up to a05a232815809a7e425b5fa7be26e0d4369894c2. Impacted is the function createnotebook/readnotebook/editcell/addcell of the file server.py. This manipulation causes path traversal. It is possible to initiate the attack remotely. The exploit h...

CVE-2026-7810

A flaw has been found in UsamaK98 python-notebook-mcp up to a05a232815809a7e425b5fa7be26e0d4369894c2. Impacted is the function createnotebook/readnotebook/editcell/addcell of the file server.py. This manipulation causes path traversal. It is possible to initiate the attack remotely. The exploit h...

CVE-2026-7810 UsamaK98 python-notebook-mcp server.py add_cell path traversal

A flaw has been found in UsamaK98 python-notebook-mcp up to a05a232815809a7e425b5fa7be26e0d4369894c2. Impacted is the function createnotebook/readnotebook/editcell/addcell of the file server.py. This manipulation causes path traversal. It is possible to initiate the attack remotely. The exploit h...

CVE-2026-7810 UsamaK98 python-notebook-mcp server.py add_cell path traversal

A flaw has been found in UsamaK98 python-notebook-mcp up to a05a232815809a7e425b5fa7be26e0d4369894c2. Impacted is the function createnotebook/readnotebook/editcell/addcell of the file server.py. This manipulation causes path traversal. It is possible to initiate the attack remotely. The exploit h...

CVE-2026-7810: Improper Limitation of a Pathname to a Restricted Directory

A flaw has been found in UsamaK98 python-notebook-mcp up to a05a232815809a7e425b5fa7be26e0d4369894c2. Impacted is the function createnotebook/readnotebook/editcell/addcell of the file server.py. This manipulation causes path traversal. It is possible to initiate the attack remotely. The exploit h...

Python Notebook MCP Path Traversal Vulnerability

Python Notebook MCP is an interactive tool developed by Usama Khatab, allowing AI assistants to operate Jupyter notebooks. Python Notebook MCP has a path traversal vulnerability, which stems from issues with the functions createnotebook/readnotebook/editcell/addcell in the file server.py,...

Fedora: Security Advisory (FEDORA-2025-7472c8fb5c)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora 43 : jupyterlab / python-notebook (2025-7472c8fb5c)

The remote Fedora 43 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2025-7472c8fb5c advisory. New jupyterlab and notebook Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested...

Fedora 42 : jupyterlab / python-notebook (2025-ebcd1295c7)

The remote Fedora 42 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2025-ebcd1295c7 advisory. New jupyterlab and notebook Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested...

Fedora: Security Advisory (FEDORA-2025-ebcd1295c7)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora: Security Advisory (FEDORA-2024-4b5f3d51ca)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora: Security Advisory (FEDORA-2025-e15a193ad3)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora: Security Advisory (FEDORA-2024-6aa3b5248f)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...