Marimo patches high-severity flaw allowing pre-cell execution of MCP commands
Marimo patched a high-severity code injection flaw in its notebook software that allowed an attacker-supplied Model Context Protocol command to run as a local subprocess before any notebook cell executed, according to VulnCheck’s CNA record.
Source: The Hacker News · August 25, 2026 at 3:01 PM · AI-assisted report
Single-source
KUALA LUMPUR, 25 AUGUST 2026 —
Marimo patched a high-severity code injection flaw in its notebook software that allowed an attacker-supplied Model Context Protocol command to run as a local subprocess before any notebook cell executed, according to VulnCheck’s CNA record.
Market Impact
The vulnerability, CVE-2026-75149, affects versions prior to 0.23.15 and carries a CVSS v3.1 score of 8.8 and v4 score of 8.7, with user interaction required and no authentication needed. The flaw lets a crafted notebook supply an MCP server command through notebook configuration, which the CNA record says launches as a local subprocess when the notebook is opened in edit mode.
Marimo fixed the issue in version 0.23.15, released July 23, 2026, and users are advised to upgrade; the latest PyPI release is 0.24.0.
Security researcher Gregory Tan, known as Grg0rry, is credited with discovering the flaw, which was disclosed August 19. Marimo’s hardening patch treats notebook metadata as attacker-controlled and enforces allowlists, removing the attacker-controlled mcp section in regression tests. The company’s security policy notes patches are provided for the latest stable release and encourages users to stay current.
The same configuration boundary was addressed in a separate advisory, CVE-2026-67618, disclosed August 4, which involved an attacker-controlled ai base_url leaking API keys during AI requests. Earlier, CVE-2026-39987 affected versions 0.20.4 and earlier by omitting authentication on the /terminal/ws endpoint, enabling full PTY shell access; Marimo lists 0.23.0 as the patched version.