CVE-2026-75149 in marimo
Summary
by MITRE • 08/19/2026
marimo before 0.23.15 contains a code injection vulnerability in the notebook configuration handler that allows attackers to execute arbitrary commands by supplying a crafted MCP server entry with an attacker-controlled command value embedded in a notebook. When the notebook is opened in edit mode, marimo launches the specified command as a local subprocess before any notebook cell is executed, requiring no authentication or cell execution to trigger the vulnerability.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 08/20/2026
The vulnerability identified in Marimo versions prior to 0.23.15 represents a critical code injection flaw within the application's notebook configuration handler. This security defect allows remote attackers to achieve arbitrary command execution on the host system by manipulating specific configuration parameters associated with Model Context Protocol (MCP) servers. The core of the issue lies in how Marimo processes and validates input data from notebooks before any actual computational logic is executed. By embedding a crafted MCP server entry containing an attacker-controlled command value directly into a notebook file, an adversary can bypass standard execution safeguards that typically require user interaction or explicit cell running to trigger code.
The technical mechanism of this exploitation relies on the application's startup and initialization sequence rather than its runtime environment. When a victim opens the maliciously crafted notebook in edit mode, Marimo attempts to initialize the configured MCP servers as part of the setup process. During this phase, the software parses the configuration data and inadvertently treats the command string provided by the attacker not as static metadata but as an executable instruction. Consequently, the application launches the specified command as a local subprocess immediately upon opening the file. This behavior occurs before any notebook cells are executed or validated for safety, meaning that no authentication is required to trigger the vulnerability, nor does it depend on the user running specific code blocks within the notebook interface.
From an operational impact perspective, this flaw poses severe risks to system integrity and confidentiality. Since the injected command executes with the privileges of the user launching Marimo, a successful exploitation can lead to complete compromise of the local environment. Attackers could use this vector to install malware, exfiltrate sensitive data, pivot into internal networks, or establish persistent backdoors on the victim's machine. The lack of authentication requirements and the ability to trigger execution simply by opening a file in edit mode significantly lowers the barrier for entry, making it particularly dangerous against users who frequently collaborate on notebooks or open files from untrusted sources such as email attachments or shared repositories.
This vulnerability aligns with CWE-78 Improper Neutralization of Special Elements used in an OS Command (OS Command Injection), specifically where input validation fails to sanitize shell metacharacters or restrict command execution contexts. Furthermore, the attack vector corresponds to ATT&CK technique T1059 Command and Scripting Interpreter, as it involves executing system commands through a legitimate application process. It also reflects aspects of T1204 User Execution, although in this case, the trigger is more passive than typical phishing scenarios since merely opening the file suffices for exploitation rather than requiring active interaction with code cells.
To mitigate this risk, organizations and individual users must immediately upgrade Marimo to version 0.23.15 or later, where these input validation checks have been strengthened. Until an update is applied, it is advisable to avoid opening notebooks from untrusted sources in edit mode and instead use read-only viewers if available. Additionally, implementing strict allow-listing for MCP server configurations can help prevent the execution of unexpected commands. Security teams should also monitor system logs for unusual subprocess creation events originating from Marimo processes to detect potential exploitation attempts in real-time.