Marimo Pre-Auth RCE Vulnerability CVE-2026-39987 Added to KEV
Summary
CISA added CVE-2026-39987 to the Known Exploited Vulnerabilities catalog on 2026-04-23. The vulnerability is a pre-authentication remote code execution flaw in marimo (a reactive Python notebook), with a CVSS 4.0 score of 9.3 (CRITICAL) and active exploitation confirmed per SSVC. Organizations running marimo versions before 0.23.0 should update immediately given the KEV status and confirmed active exploitation.
“The terminal WebSocket endpoint /terminal/ws lacks authentication validation, allowing an unauthenticated attacker to obtain a full PTY shell and execute arbitrary system commands.”
About this source
GovPing monitors CISA Known Exploited Vulnerabilities (KEV) for new data privacy & cybersecurity regulatory changes. Every update since tracking began is archived, classified, and available as free RSS or email alerts — 37 changes logged to date.
What changed
CISA added CVE-2026-39987 to its Known Exploited Vulnerabilities (KEV) catalog. The entry documents a pre-authentication remote code execution vulnerability in the /terminal/ws WebSocket endpoint of marimo (a reactive Python notebook), affecting versions before 0.23.0. The CVSS 4.0 score is 9.3 (CRITICAL) and SSVC assessment confirms active exploitation with total technical impact.
Organizations running marimo should immediately identify affected instances and update to version 0.23.0 or later. Federal agencies face binding remediation requirements under existing CISA directives for KEV catalog entries.
Archived snapshot
Apr 24, 2026GovPing captured this document from the original source. If the source has since changed or been removed, this is the text as it existed at that time.
Required CVE Record Information
CNA: GitHub (maintainer security advisories)
Updated:
2026-04-09
Description
marimo is a reactive Python notebook. Prior to 0.23.0, Marimo has a Pre-Auth RCE vulnerability. The terminal WebSocket endpoint /terminal/ws lacks authentication validation, allowing an unauthenticated attacker to obtain a full PTY shell and execute arbitrary system commands. Unlike other WebSocket endpoints (e.g., /ws) that correctly call validate_auth() for authentication, the /terminal/ws endpoint only checks the running mode and platform support before accepting connections, completely skipping authentication verification. This vulnerability is fixed in 0.23.0.
CWE 1 Total
Learn more
- CWE-306: CWE-306: Missing Authentication for Critical Function
CVSS 1 Total
Learn more
| Score | Severity | Version | Vector String |
| --- | --- | --- | --- |
| 9.3 | CRITICAL | 4.0 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N |
Product Status
Learn more Versions 1 Total
Default Status: unknown
affected
- affected at < 0.23.0
References 3 Total
- github.com: https://github.com/marimo-team/marimo/security/advisories/GHSA-2679-6mx9-h9xc
- github.com: https://github.com/marimo-team/marimo/pull/9098
- github.com: https://github.com/marimo-team/marimo/commit/c24d4806398f30be6b12acd6c60d1d7c68cfd12a
Authorized Data Publishers
CISA-ADP
SSVC and KEV, plus CVSS and CWE if not provided by the CNA.
SSVC 1 Total
Learn more
| Exploitation | Automatable | Technical Impact | Version | Date Accessed |
| --- | --- | --- | --- | --- |
| active | yes | total | 2.0.3 | 2026-04-23 |
KEV 1 Total
Learn more
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-39987 (2026-04-23)
Mentioned entities
Parties
Related changes
Get daily alerts for CISA Known Exploited Vulnerabilities (KEV)
Daily digest delivered to your inbox.
Free. Unsubscribe anytime.
Source
About this page
Every important government, regulator, and court update from around the world. One place. Real-time. Free. Our mission
Source document text, dates, docket IDs, and authority are extracted directly from CISA.
The summary, classification, recommended actions, deadlines, and penalty information are AI-generated from the original text and may contain errors. Always verify against the source document.
Classification
Who this affects
Taxonomy
Browse Categories
Get alerts for this source
We'll email you when CISA Known Exploited Vulnerabilities (KEV) publishes new changes.
Subscribed!
Optional. Filters your digest to exactly the updates that matter to you.