Marimo GHSA-2679-6mx9-h9xc / NVD: CVE-2026-39987 is a pre-authentication RCE in the reactive Python notebook server. The /terminal/ws WebSocket lacks auth, giving an unauthenticated attacker a full PTY shell. NVD: versions prior to 0.23.0 affected; CVSS 3.1 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H); CVSS 4.0 9.3 also published. Exploit-DB 52673 (2 Sep 2026) shipped a public PoC (cited ≤0.20.4).

UPDATE 15 September 2026 (Sysdig Threat Research): Sysdig observed a skilled human operator exploit this CVE, pivoting from Marimo to AWS Secrets Manager then an SSH bastion in eight seconds with a hand-rolled Python toolkit (850+ interactive commands over a nine-hour session; source IP 172.236.12.17). Upgrade to 0.23.0+; never expose Marimo terminal WebSockets to the internet. (sources: Marimo GHSA-2679-6mx9-h9xc; NVD; Sysdig)

UPDATE (26 Oct 2026): CISA added CVE-2026-39987 to its Known Exploited Vulnerabilities catalog on 23 April 2026, with a 7 May due date for US federal agencies.

Marimo's GitHub advisory rates it Critical and lists 0.23.0 as the patched version. (source: CISA KEV catalog; Marimo GitHub advisory)

Correction (02 Nov 2026): removed The Hacker News as a source; removed details no other source gives. (source: Sysdig)