marimo-team/marimo

GitHub

github.com

marimo.io

Releases395

Frequency2 days 13 hours

Last Release 12 days ago

Stars21.3K

A reactive notebook for Python — run reproducible experiments, query with SQL, execute as a script, deploy as an app, and version with git. Stored as pure Python. All in a modern, AI-native editor.

CVE History

CVE	Published	CVSS v3	CVSS v2
CVE-2026-39987 ↗	Apr 9, 2026Thursday, 9 April 2026, 18:17	9.8 CRITICAL	—
marimo is a reactive Python notebook. Prior to 0.23.0, Marimo has a Pre-Auth RCE vulnerability. The terminal WebSocket endpoint /terminal/ws lacks authentication validation, allowing an unauthenticated attacker to obtain a full PTY shell and execute arbitrary system commands. Unlike other WebSocket endpoints (e.g., /ws) that correctly call validate_auth() for authentication, the /terminal/ws endpoint only checks the running mode and platform support before accepting connections, completely skipping authentication verification. This vulnerability is fixed in 0.23.0.