Marimo 0.20.4 Remote Code Execution

Marimo version 0.20.4 and earlier contains a missing authentication issue in the terminal WebSocket endpoint that can allow unauthenticated command execution. The submission provides documentation and Docker lab configurations for vulnerable and patched versions...

Missing Authentication for Critical Function

Overview marimo is an A library for making reactive notebooks and apps Affected versions of this package are vulnerable to Missing Authentication for Critical Function via the terminal/ws WebSocket endpoint, which lacks authentication validation. An unauthenticated attacker can gain unauthorized...

CVE-2025-55300

Komari is a lightweight, self-hosted server monitoring tool designed to provide a simple and efficient solution for monitoring server performance. Prior to 1.0.4-fix1, WebSocket upgrader has disabled origin checking, enabling Cross-Site WebSocket Hijacking CSWSH attacks against authenticated user...