CVE-2026-75149: falha de alta gravidade em marimo-team marimo
marimo < 0.23.15 Code Injection via MCP Server Configuration
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 8.7epss 1.0%
marimo before 0.23.15 contains a code injection vulnerability in the notebook configuration handler that allows attackers to execute arbitrary commands by supplying a crafted MCP server entry with an attacker-controlled command value embedded in a notebook. When the notebook is opened in edit mode, marimo launches the specified command as a local subprocess before any notebook cell is executed, requiring no authentication or cell execution to trigger the vulnerability.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Produtos afetados
marimo-team · marimoCVEs relacionadas — marimo-team marimo
No mesmo produto, das mais perigosas para as menos.
CVE-2026-39987CRITICALmarimo Affected by Pre-Auth Remote Code Execution via Terminal WebSocket Authentication BypassEPSS 99.7%KEVCVE-2026-67618HIGHmarimo < 0.23.15 API Key Exfiltration via Malicious Notebook PEP-723 MetadataEPSS 0.3%CVE-2026-54386MEDIUMmarimo < 0.23.9 XSS via file Query Parameter in assets.pyEPSS 0.2%