marimo Reactive Python Notebook Pre-Auth Remote Code Execution (RCE) via Terminal WebSocket Authentication Bypass (CVE-2026-39987)

1. Apply Official Security Patch (Recommended)

Upgrade your marimo dependency to version 0.23.0 or higher.

# Using pip
pip install --upgrade marimo>=0.23.0

# Using poetry
poetry add marimo@latest

2. Temporary Mitigations (If patching cannot be applied immediately)

• Network Access Control: Restrict access to the marimo server port using firewalls or security groups, allowing connections only from trusted IP addresses.
• Reverse Proxy Authentication: Deploy a reverse proxy (e.g., Nginx, Apache, or OAuth2 Proxy) in front of marimo to enforce authentication (such as Basic Auth or OIDC) before requests reach the application.
• WAF Rules: Configure Web Application Firewall (WAF) rules to block unauthorized WebSocket upgrade requests targeting the /terminal/ws path.

marimo is a reactive Python notebook widely adopted in data science and machine learning workflows. This vulnerability (CVE-2026-39987) stems from a missing authentication check on the terminal WebSocket endpoint /terminal/ws (CWE-306: Missing Authentication for Critical Function).

While other WebSocket endpoints (such as /ws) properly invoke validate_auth() to verify user credentials, the /terminal/ws endpoint only checks the running mode and platform support before accepting connections, completely bypassing authentication verification. Consequently, an unauthenticated attacker can initiate a WebSocket handshake with the vulnerable endpoint, spawn an interactive pseudo-terminal (PTY) shell, and execute arbitrary system commands under the privileges of the running marimo process.

This vulnerability has been assigned a CVSS score of 9.8 (Critical) and is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, indicating active exploitation in the wild.