/Vulnerability Library

Marimo <= 0.20.4 - Pre-Auth Terminal WebSocket RCE

CVE-2026-39987
Verified

Description

Marimo versions <= 0.20.4 contain an unauthenticated remote code execution vulnerability. The terminal WebSocket endpoint /terminal/ws lacks authentication validation, allowing an unauthenticated attacker to connect via WebSocket, obtain a full PTY shell, and execute arbitrary OS commands on the underlying server.

Severity

Critical

CVSS Score

9.3

Exploit Probability

38%

Affected Product

marimo

Published Date

April 9, 2026

Template Author

ritikchaddha

CVE-2026-39987.yaml
9.3Score

CVSS Metrics

CVSS Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N
CVE ID:
cve-2026-39987
CWE ID:
cwe-306

References

https://github.com/advisories/GHSA-2679-6mx9-h9xchttps://nvd.nist.gov/vuln/detail/CVE-2026-39987https://github.com/marimo-team/marimo

Remediation Steps

Upgrade to Marimo version 0.23.0 or later which adds authentication validation to the terminal WebSocket endpoint.