KEV: Marimo remote code execution vulnerability (CVE-2026-39987)¶

Signal: Added to CISA KEV on 2026-04-28 (due 2026-05-07). Marimo is being tracked as exploited in the wild.

What it is¶

Marimo contains a pre-authorization remote code execution vulnerability. Treat this as an urgent notebook / AI-workbench exposure issue: if an attacker can reach the service, shell access and arbitrary command execution may follow.

References: - CISA KEV entry: https://www.cisa.gov/known-exploited-vulnerabilities-catalog - NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-39987

Triage¶

Inventory all Marimo deployments:
developer workstations
shared notebook servers
internal demo environments
exposed lab or training instances
Check exposure:
public IPs / DNS names
reverse proxies / tunnels
auth in front of the service
Identify versions and any shared execution hooks.
Confirm whether the instance can run user-supplied code or launch shells.

Mitigation¶

Upgrade or remove the service immediately using vendor guidance.
If you cannot patch quickly, isolate affected hosts from untrusted networks.
Disable public exposure until remediation is complete.
Revoke or rotate secrets on impacted hosts if compromise is suspected.

Hunt / detection¶

Review logs for:
unexpected notebook execution requests
shell spawn events
new files under workspace, temp, or cache paths
unusual outbound connections after notebook activity
Correlate with endpoint telemetry for:
child processes from the Marimo service
script interpreters or downloaders
persistence created around launch time

Recovery notes¶

If exploitation is suspected: - disconnect the host and preserve evidence - collect process, network, and file telemetry before cleanup - verify notebook artifacts and uploaded content - reimage or restore the host if trust cannot be proven