Marimo Notebook Flaw Could Run MCP Commands Before Cells Execute in Edit Mode

What it is

CVE-2026-75149 is a high-severity code injection flaw in the Marimo Python notebook, affecting all versions before 0.23.15. VulnCheck (the CNA) rates it CVSS v4 8.7 / CVSS v3.1 8.8, with user interaction required but no attacker authentication. Published August 19, 2026; credited to Gregory Tan (handle Grg0rry), who also co-authored Marimo's fix. This resolves the "unverified details" gap in the existing summary — it is a real, patched CVE with a concrete mechanism.

How it works

A crafted notebook supplies an attacker-controlled MCP server command through notebook configuration/metadata. When the victim opens that notebook in edit mode, Marimo launches the specified command as a local subprocess — before any notebook cell is executed. So merely opening (not running) a malicious notebook is enough. The fix hardens PEP 723 metadata handling by treating notebook metadata as attacker-controlled and passing it through an allowlist that strips these notebook-supplied sections: ai, mcp, completion, secrets, server. The regression test uses an attacker-controlled URL and confirms the mcp section is removed.

Preconditions / Affected

• Marimo < 0.23.15.
• Victim must open the malicious notebook in edit mode. No prior authentication needed on the attacker side.

What to do

Upgrade beyond the affected range. Marimo fixed this in 0.23.15 (released July 23, 2026); current PyPI release as of August 25 is 0.24.0 (released August 17). Do not treat opening a notebook as safe — the subprocess fires before cell execution, so "I didn't run any cells" is not protection on unpatched versions.

Related flaws (same config boundary)

The page documents two adjacent issues worth tracking together:

• CVE-2026-67618 (CVSS 7.1, disclosed Aug 4, 2026): also < 0.23.15. An attacker-controlled AI base_url in notebook metadata means that after the operator later makes an AI request, their API key is sent to the attacker's endpoint — again without executing any cell.
• CVE-2026-39987 (separate, earlier): versions 0.20.4 and earlier had missing authentication on the /terminal/ws endpoint, allowing requests to obtain a full PTY shell and run arbitrary commands. Patched in 0.23.0.

Caveats

The subprocess-before-cell behavior for CVE-2026-75149 comes from the CNA record; the patch's regression test verifies removal of the mcp config section using an attacker-controlled URL, which is described as separate from that command-to-subprocess behavior.