A high-severity security vulnerability has been discovered and patched in Marimo notebook software. The flaw allowed an attacker to execute attacker-supplied Model Context Protocol (MCP) commands via a specially crafted notebook file. The malicious command could run as a local subprocess when the notebook is opened in edit mode, potentially before any cells execute. The vulnerability was documented by VulnCheck's CVE Numbering Authority (CNA). Marimo has addressed the issue with a fix. The flaw poses significant risk as it could enable arbitrary command execution on a victim's local system simply by opening a crafted notebook.
CVE-2026-75149 is a high-severity code injection vulnerability in Marimo notebook software affecting versions prior to 0.23.15. When a specially crafted notebook is opened in edit mode, an attacker-supplied Model Context Protocol (MCP) server command embedded in the notebook configuration is launched as a local subprocess before any notebook cell is executed. The attack requires user interaction (opening the notebook) but no attacker authentication. The flaw originates from notebook metadata (PEP 723) not being treated as attacker-controlled, allowing malicious configuration sections including 'ai', 'mcp', 'completion', 'secrets', and 'server' to be processed unsafely. The patch introduces an allowlist approach that strips these configuration sections when sourced from notebook metadata. A related vulnerability, CVE-2026-67618 (CVSS 7.1), also in versions before 0.23.15, allows an attacker-controlled AI base_url in notebook metadata to exfiltrate an operator's API key to an attacker-controlled endpoint when the operator makes an AI request. A prior vulnerability, CVE-2026-39987, affected Marimo versions 0.20.4 and earlier via missing authentication on the /terminal/ws WebSocket endpoint, allowing unauthenticated access to a full PTY shell and arbitrary command execution.
Upgrade Marimo to version 0.23.15 or later (current PyPI release is 0.24.0 as of August 25). The patch treats all notebook-supplied metadata as attacker-controlled and removes the following configuration sections sourced from notebook files: 'ai', 'mcp', 'completion', 'secrets', and 'server'. Users should avoid opening untrusted Marimo notebooks in edit mode until patched. Follow Marimo's security policy by staying on the latest stable release to receive security patches promptly.
