What is CVE-2026-39987 in Marimo?

Critical pre-auth RCE via `/terminal/ws` WebSocket, giving shell access in versions ≤0.20.4.

How fast was Marimo exploited?

Under 10 hours post-disclosure; creds stolen in <3 minutes.

How to fix Marimo RCE vulnerability?

Upgrade to 0.23.0, block `/terminal/ws`, rotate secrets, firewall external access.

🕳️ Vulnerabilities & CVEs

[Critical RCE] Marimo Flaw Exploited 10 Hours Post-Disclosure

Q: How to fix Marimo RCE vulnerability?

Upgrade to 0.23.0, block `/terminal/ws`, rotate secrets, firewall external access.

Ten hours. That's all it took for attackers to weaponize a gaping hole in Marimo, the hot Python notebook tool with 20k GitHub stars. Sysdig caught them in the act, swiping secrets like it was nothing.

CVE Watch Apr 14, 2026 4 min read

Red alert graphic showing exploited Marimo WebSocket terminal with code leaking credentials

⚡ Key Takeaways

Hackers exploited Marimo RCE (CVE-2026-39987) in under 10 hours, stealing creds in <3 minutes. 𝕏
Affects exposed editable notebooks; 20k-star project popular with data scientists. 𝕏
Patch to 0.23.0 immediately or block /terminal/ws endpoint. 𝕏
Echoes 2019 Jupyter cryptojacking; expect exploit kits soon. 𝕏