CVE-2026-39987
Description
CVE-2026-39987 is a critical pre-auth RCE in Marimo notebooks via the terminal WebSocket endpoint. Update to version 0.23.0 immediately.
CPE
| Product | Version Start | Version End (excl.) | Status |
|---|---|---|---|
| marimo | * | 0.23.0 | vulnerable |
Related weakness (CWE)
Remediation plan
Apply official patches
Update your Marimo installation to version 0.23.0 or later, which introduces the necessary authentication validation for the terminal WebSocket endpoint.
Update affected systems
Identify all instances of Marimo running versions prior to 0.23.0 and ensure they are upgraded immediately to mitigate the risk of unauthorized shell access.
Restrict access
Implement network-level access controls, such as firewalls or VPNs, to ensure that Marimo instances are not exposed to the public internet, specifically blocking unauthorized access to the /terminal/ws endpoint.
Monitor for exploitation
Review application logs for unusual connection requests to the /terminal/ws endpoint, especially those originating from unexpected IP addresses or occurring without corresponding authenticated sessions.
Detection Guidance
Detection should focus on identifying unauthorized WebSocket upgrades to the /terminal/ws path. Monitor web server and application logs for HTTP 101 Switching Protocols responses to this specific endpoint from unauthenticated or external IP addresses. Additionally, look for unusual child processes spawned by the Marimo application, such as unexpected shell activity (e.g., /bin/sh, /bin/bash) or network callouts that deviate from normal data science workflows.