{"id":96,"date":"2026-04-10T09:00:00","date_gmt":"2026-04-10T09:00:00","guid":{"rendered":"https:\/\/thecybersecurity.network\/blog\/marimo-rce-flaw-cve-2026-39987-exploited-within-10-hours-of-disclosure\/"},"modified":"2026-04-12T20:03:40","modified_gmt":"2026-04-12T20:03:40","slug":"marimo-rce-flaw-cve-2026-39987-exploited-within-10-hours-of-disclosure","status":"publish","type":"post","link":"https:\/\/thecybersecurity.network\/blog\/marimo-rce-flaw-cve-2026-39987-exploited-within-10-hours-of-disclosure\/","title":{"rendered":"Marimo RCE Flaw CVE-2026-39987 Exploited Within 10 Hours of Disclosure"},"content":{"rendered":"<p>A critical security vulnerability in Marimo, an open-source Python notebook for data science and analysis, has been actively exploited within just 10 hours of public disclosure, highlighting the growing speed of weaponization in the modern threat landscape.<\/p>\n<h2>Overview<\/h2>\n<p>CVE-2026-39987 is a Remote Code Execution (RCE) vulnerability affecting Marimo versions prior to 0.8.12. The flaw exists in the notebook&#8217;s cell execution engine, allowing an attacker to craft a malicious notebook file that executes arbitrary code on the host system when opened.<\/p>\n<h2>Technical Details<\/h2>\n<p>The vulnerability stems from:<\/p>\n<ul>\n<li>Insufficient sandboxing of Python cell execution<\/li>\n<li>Lack of input validation on notebook import functionality<\/li>\n<li>Deserialization of untrusted data from shared notebook URLs<\/li>\n<\/ul>\n<p>CVSS Score: <strong>9.8 Critical<\/strong> (AV:N\/AC:L\/PR:N\/UI:N\/S:U\/C:H\/I:H\/A:H)<\/p>\n<h2>Impact Assessment<\/h2>\n<p>Data science teams and research environments using shared Marimo notebooks are at highest risk. Exploitation can lead to complete host compromise, data exfiltration, and lateral movement within research networks.<\/p>\n<h2>Affected Versions<\/h2>\n<ul>\n<li>Marimo &lt; 0.8.12 \u2014 Vulnerable<\/li>\n<li>Marimo &gt;= 0.8.12 \u2014 Patched<\/li>\n<\/ul>\n<h2>Recommended Mitigations<\/h2>\n<ol>\n<li>Update Marimo immediately: <code>pip install --upgrade marimo<\/code><\/li>\n<li>Never open notebook files from untrusted sources<\/li>\n<li>Run Marimo in isolated Docker containers<\/li>\n<li>Review shared notebook URLs for malicious content<\/li>\n<\/ol>\n<p><em>Written by Tarang Parmar (CEH) \u2014 TheCyberSecurity.Network. Read time: 4 min.<\/em><\/p>\n","protected":false},"excerpt":{"rendered":"<p>A critical security vulnerability in Marimo, an open-source Python notebook for data science and analysis, has been actively exploited within just 10 hours of public disclosure.<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[42],"tags":[37,11,14,13,12,35],"class_list":["post-96","post","type-post","status-publish","format-standard","hentry","category-vulnerability","tag-critical","tag-cve202639987","tag-marimo","tag-python","tag-rce","tag-vulnerability"],"_links":{"self":[{"href":"https:\/\/thecybersecurity.network\/blog\/wp-json\/wp\/v2\/posts\/96","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/thecybersecurity.network\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/thecybersecurity.network\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/thecybersecurity.network\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/thecybersecurity.network\/blog\/wp-json\/wp\/v2\/comments?post=96"}],"version-history":[{"count":1,"href":"https:\/\/thecybersecurity.network\/blog\/wp-json\/wp\/v2\/posts\/96\/revisions"}],"predecessor-version":[{"id":108,"href":"https:\/\/thecybersecurity.network\/blog\/wp-json\/wp\/v2\/posts\/96\/revisions\/108"}],"wp:attachment":[{"href":"https:\/\/thecybersecurity.network\/blog\/wp-json\/wp\/v2\/media?parent=96"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/thecybersecurity.network\/blog\/wp-json\/wp\/v2\/categories?post=96"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/thecybersecurity.network\/blog\/wp-json\/wp\/v2\/tags?post=96"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}