Marimo RCE Vulnerability Exploited Within 10 Hours of Public Disclosure

A critical remote code execution (RCE) vulnerability in the open-source Python notebook platform Marimo was actively exploited less than 10 hours after its public disclosure.

The flaw, initially tracked as GHSA-2679-6mx9-h9xc and later assigned CVE-2026-39987, carries a critical CVSS score of 9.3. It allows unauthenticated attackers to gain a full interactive shell on exposed Marimo instances.

Security researchers at Sysdig observed the first exploitation attempts in the wild merely 9 hours and 41 minutes after the advisory was published on April 8, 2026.

Technical Details of the Vulnerability

Marimo is a modern, reactive alternative to Jupyter notebooks widely used by data scientists and AI researchers.

The critical vulnerability affects the application’s terminal WebSocket endpoint, located at the /terminal/ws path, in versions 0.20.4 and earlier.

ls          → marimo  logs  data  .env  docker-compose.yml  celerybeat-schedule
cat .env    → HOME=/app/marimo
               PATH=/usr/local/bin:/usr/bin:/bin
               HOSTNAME=prod-app-e29e
               AWS_DEFAULT_REGION=us-east-1
               AWS_ACCESS_KEY_ID=AKIA01FB...

While other WebSocket endpoints in the Marimo application correctly verify user sessions by calling an authentication validation function, the terminal endpoint completely skips this essential security check.

Consequently, any attacker who opens a network connection to this specific endpoint is instantly granted a persistent pseudo-terminal shell.

This interactive shell runs with the full privileges of the Marimo process. This means no passwords, security tokens, or complex payload crafting are required to compromise the affected system.

The speed of this attack highlights a dangerous and evolving trend in the global cybersecurity landscape. At the time of the initial attack, there was no publicly available proof-of-concept (PoC) exploit code.

Threat actors were able to build a fully working exploit directly from the technical description provided in the vulnerability advisory.

Security experts suggest that attackers are increasingly using artificial intelligence to rapidly analyze advisory feeds and weaponize flaws in niche software.

Sysdig researchers captured the entire attack flow using deceptive honeypot servers. The intrusion began with a brief automated script to confirm remote code execution capabilities.

Two minutes later, a human operator took over to manually explore the victim’s underlying file system.

Within just three minutes of gaining access, the attacker successfully located and extracted a .env file containing highly sensitive cloud infrastructure credentials, including active AWS access keys.

The rapid targeting of Marimo, which has roughly 20,000 GitHub stars, proves that attackers do not just focus on massive, mainstream enterprise platforms. Organizations must treat this vulnerability as a high-priority incident.

Administrators are strongly urged to immediately upgrade all Marimo deployments to version 0.23.0, which officially patches the exposed /terminal/ws endpoint.

Furthermore, security teams should actively review network logs for any unauthorized connections to the terminal path and immediately rotate any API keys, database passwords, or cloud credentials stored in previously exposed notebook environments.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.