"The command can run as a local subprocess when the notebook is opened in edit mode," the CNA record for CVE-2026-75149 states — a terse description of a high-severity flaw that could let attacker-supplied Model Context Protocol (MCP) commands run on a user's machine before any notebook cell executes.
CVE-2026-75149: how the flaw works
VulnCheck's CVE Numbering Authority (CNA) record traces the vulnerability, tracked as CVE-2026-75149, to code injection in Marimo notebook software versions prior to 0.23.15. The CNA assigns the issue a CVSS v4 score of 8.7 and a CVSS v3.1 score of 8.8. The record notes that the flaw requires user interaction — opening a specially crafted notebook in edit mode — but does not require attacker authentication.
According to an OSV CVE import referenced by the CNA, a crafted notebook can supply an attacker-controlled MCP server command through notebook configuration. When a victim opens that notebook in edit mode, the CNA record says the specified command is launched as a local subprocess before any notebook cell is executed. In plain terms: notebook metadata, under certain conditions, could cause the host to run an attacker-provided command immediately upon opening for edit.
Marimo's PEP 723 hardening and the 0.23.15 patch
Marimo addressed the issue in release 0.23.15. The project's PEP 723 hardening patch changes assumptions about notebook metadata: it treats metadata as attacker-controlled and forwards notebook-supplied configuration only through an allowlist. The patch removes the following notebook-supplied configuration sections from what the application will honor: ai, mcp, completion, secrets, and server.
Marimo's regression test for MCP uses an attacker-controlled URL and explicitly verifies that the mcp section is removed. The CNA record documents the specific command-to-subprocess behavior for CVE-2026-75149 that the patch seeks to block.
This site is the portfolio.
OSINTSights runs on Cloudflare Workers, D1, R2, and Vectorize, with an AI pipeline on Hetzner ARM. Nubivance designed, built, and operates it. We do the same for clients.
See what we buildNearby vulnerabilities: CVE-2026-67618 and CVE-2026-39987
The CNA record places CVE-2026-75149 in context with two other Marimo advisories. VulnCheck previously disclosed CVE-2026-67618 (CVSS 7.1) on August 4, 2026; that flaw also affected Marimo versions before 0.23.15 and involved an attacker-controlled AI base_url supplied through notebook metadata. For CVE-2026-67618, an operator opening a malicious notebook could later make an AI request that sent the operator's API key to the configured endpoint — again without any notebook cell needing to be executed.
Separately, Marimo's advisory for CVE-2026-39987 describes an earlier flaw that affected versions 0.20.4 and earlier. That issue involved missing authentication validation on the /terminal/ws endpoint; requests reaching the endpoint could obtain a full pseudo-terminal (PTY) shell that could execute arbitrary commands. Marimo lists version 0.23.0 as the patched release for that earlier flaw.
Discovery, timeline and releases
The CNA record credits Gregory Tan, who uses the handle Grg0rry, with discovering CVE-2026-75149. The same handle also appears as a co-author on Marimo's PEP 723 hardening commit. Marimo published version 0.23.15 on July 23, 2026; the CVE was published on August 19, 2026. The Hacker News confirmed on August 25 that the current PyPI release is version 0.24.0, released August 17.
Marimo's security policy, as summarized in the record, says security patches are provided for the latest stable release and encourages users to stay current. The CNA and OSV notes both advise that users running an affected release should move to a version outside the affected range.
What this means for technologists, procurement teams, and end users
- Technologists and security teams: review deployments that host Marimo notebooks and confirm the running version. The CNA and OSV descriptions indicate that simply opening a crafted notebook in edit mode — not executing cells — can trigger a local subprocess, so scope and access controls for any machine that can edit notebooks are relevant.
- Affected enterprises and procurement leaders: confirm whether internal policies require pinned versions or automatic updates. Marimo's policy limits security support to the latest stable release, and the vendor's patches for these metadata-related boundaries were applied in 0.23.15 and later.
- End users and developers who share notebooks: avoid opening untrusted notebooks in edit mode on systems with sensitive access until their Marimo installations are on fixed versions; the record shows notebook-supplied metadata such as mcp and ai can be treated as attacker-controlled and may trigger network or subprocess behavior.
Marimo's PEP 723 hardening moves metadata handling toward a whitelist model and strips several configuration sections from notebook-supplied data — an explicit architectural response to the kinds of metadata-to-action risks described in the CVE records. The practical step the CNA and OSV records recommend is straightforward: move off affected releases (versions prior to 0.23.15) to a patched release. Beyond that, the incident underscores that notebook metadata, not only cell code, can be an attack vector.
For the original reporting, see The Hacker News.
