Marimo's Terminal Shell Cracked Open: CVE-2026-39987 Exploited in Under 10 Hours
Nine hours, forty-one minutes. That's all it took for some shadowy operator to pounce on Marimo's freshly disclosed RCE bug. No public exploit code, just a advisory and sheer opportunism.
⚡ Key Takeaways
- CVE-2026-39987 enabled unauth RCE in Marimo via exposed terminal WebSocket, exploited in under 10 hours sans PoC. 𝕏
- Attackers manually recon'd honeypots for creds and keys, showing human-driven, opportunistic hits on niche tools. 𝕏
- Niche data science apps like Marimo are now prime targets—architectural auth slips in reactive UIs fuel rapid weaponization. 𝕏
Worth sharing?
Get the best Cybersecurity stories of the week in your inbox — no noise, no spam.
Originally reported by The Hacker News
Related Stories
Vulnerabilities & CVEs
Hackers Crack Marimo's Critical Flaw in Under 10 Hours—No PoC Needed
Vulnerabilities & CVEs
Flowise's Perfect-Score Flaw CVE-2025-59528: Attackers Already Inside
Vulnerabilities & CVEs
Flowise's RCE Nightmare: 15,000 Exposed Servers in Hackers' Sights
Vulnerabilities & CVEs