CVE-2026-39987

CVE-2026-39987 — Marimo Pre-Auth RCE /terminal/ws root@kitploit: CVSS 4.0 : 9.3 CRITICAL CVSS 3.x : 9.8 CRITICAL CWE : CWE-306 Missing Authentication for Critical Function Fix : Marimo 0.23.0+ Affects : Marimo Lab / authorized testing only HTB, CTF, engagement with written scope. Table of content...

CVE-2026-39987

CVE-2026-39987 marimo is a reactive Python notebook. Prior to 0.23.0, Marimo has a Pre-Auth RCE vulnerability root@kitploit: / | |// / / / / / / |/ |/ \ / | | | \ /| | /| //|/|/ / | | | / -----/ | |/ |/ ----- \ | |/ \ / / / / //// / | |// CVE-2026-39987 Marimo /terminal/ws —...

CVE-2026-39987

CVE-2026-39987 Exploit POC Overview This repository contains a Proof-of-Concept POC script for CVE-2026-39987, a pre-authentication Remote Code Execution RCE vulnerability in Marimo. The exploit leverages a WebSocket endpoint to execute arbitrary commands on the target system. Vulnerability Detai...

CVE-2026-39987-lab-or-marimo-cve-lab

CVE-2026-39987 Lab Guide Pre-Auth Remote Code Execution via Terminal WebSocket Authentication Bypass An educational Docker lab for understanding, reproducing, and patching this critical vulnerability in marimo. Table of Contents Overview Architecture Quick Start Step-by-Step Walkthrough Step 1:...

cve-2026-39987

cve-2026-39987 Installation • Usage • Examples I'm just trying out Go :D Btw: CVE-2026-39987 PoC: Marimo:PORT/terminal/ws REDACTED@REDACTED:$ uname -a Linux ... REDACTED@REDACTED:$ exit exit INF:normalclose websocket: close 1000 normal: Terminal session ended Custom Command -c: r...

CVE-2026-39987

CVE-2026-39987 — Marimo Pre-Auth RCE For educational and authorized security research purposes only. Description Pre-authenticated Remote Code Execution in Marimo = 0.20.4. The WebSocket endpoint /terminal/ws skips authentication validation, allowing an unauthenticated attacker to obtain a full...

CVE-2026-63722 ICEcoder 8.1 Unauthenticated RCE via terminal-xhr.php

ICEcoder 8.1 contains an unauthenticated remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary OS commands by chaining an authentication bypass, CSRF validation bypass, and unsanitized command execution. Attackers can send a single HTTP POST request to the...

Exploit for Missing Authentication for Critical Function in Coreweave Marimo

CVE-2026-39987 For Marimo 0.20.4 PoC ⚠️ This tool is int...

Exploit for Missing Authentication for Critical Function in Coreweave Marimo

CVE-2026-39987 Marim...

SUSE CVE-2026-53522

Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. From version 1.0.0 to before version 2.2.0, the Nezha dashboard exposes two endpoints that create long-lived WebSocket streams to monitored agents: POST /api/v1/terminal - createTerminal...

GHSA-JG62-J5H6-8MPQ Nezha Monitoring: Unbounded WebSocket Streams — Resource Exhaustion DoS

Description The Nezha dashboard exposes two endpoints that create long-lived WebSocket streams to monitored agents: - POST /api/v1/terminal → createTerminal terminal.go:27-67 - POST /api/v1/file → createFM fm.go:28-67 Both call rpc.NezhaHandlerSingleton.CreateStreamstreamId, ... which inserts a...

CVE-2026-53522 Nezha Monitoring: Unbounded WebSocket Streams — Resource Exhaustion DoS

Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. From version 1.0.0 to before version 2.2.0, the Nezha dashboard exposes two endpoints that create long-lived WebSocket streams to monitored agents: POST /api/v1/terminal → createTerminal...

Exploit for Missing Authentication for Critical Function in Coreweave Marimo

CVE-2026-39987 - Marimo Pre-Auth RCE Unauthenticated Remote...

Command Injection

Overview ajenti is a Linux & BSD web admin panel. Affected versions of this package are vulnerable to Command Injection via the /api/terminal/create endpoint. An attacker can execute arbitrary system commands by sending a specially crafted payload after authentication, potentially establishing a...

GHSA-VXW4-WV6M-9HHH OpenCode's Unauthenticated HTTP Server Allows Arbitrary Command Execution

Previously reported via email to [email protected] on 2025-11-17 per the security policy in opencode-sdk-js/SECURITY.md. No response received. Summary OpenCode automatically starts an unauthenticated HTTP server that allows any local process—or any website via permissive CORS—to execute arbitrary...

Komari vulnerable to Cross-site WebSocket Hijacking

Summary WebSocket upgrader has disabled origin checking, enabling Cross-Site WebSocket Hijacking CSWSH attacks against authenticated users Details https://github.com/komari-monitor/komari/blob/bd5a6934e1b79a12cf1e6a9bba5372d0e04f3abc/api/terminal.goL33-L35 Any third party website can send request...

GHSA-Q355-H244-969H Komari vulnerable to Cross-site WebSocket Hijacking

Summary WebSocket upgrader has disabled origin checking, enabling Cross-Site WebSocket Hijacking CSWSH attacks against authenticated users Details https://github.com/komari-monitor/komari/blob/bd5a6934e1b79a12cf1e6a9bba5372d0e04f3abc/api/terminal.goL33-L35 Any third party website can send request...

1E Platform Security Vulnerability

1E Platform is a terminal endpoint management and automation solution from 1E. A security vulnerability exists in versions prior to 1E Platform v18.1 that stems from a command that fails to properly validate input parameters, allowing specially crafted inputs to execute arbitrary code with system...