Marimo Notebook High-Severity Flaw Allows MCP Command Execution Before Cell Execution

Marimo, the developer of the open-source Marimo notebook software, has patched a high-severity code injection vulnerability tracked as CVE-2026-75149. The flaw, discovered by security researcher Gregory Tan (handle Grg0rry), allows an attacker to execute arbitrary Model Context Protocol (MCP) commands as a local subprocess when a specially crafted notebook is opened in edit mode.

According to VulnCheck’s CNA record, the vulnerability affects Marimo versions prior to 0.23.15 and carries a CVSS v4 score of 8.7 and a CVSS v3.1 score of 8.8. The attack requires user interaction (opening the malicious notebook) but no authentication. The command is launched before any notebook cell executes, making it a serious risk for developers who open untrusted notebooks.

Marimo addressed the issue in version 0.23.15, released on July 23, 2026. The patch, part of Marimo’s PEP 723 hardening, treats notebook metadata as attacker-controlled and passes notebook-supplied configuration through an allowlist. The patch removes notebook-supplied configuration sections including ‘ai’, ‘mcp’, ‘completion’, ‘secrets’, and ‘server’. The MCP regression case uses an attacker-controlled URL and verifies that the ‘mcp’ section is removed.

The current PyPI release is version 0.24.0, released August 17, 2026. Users are strongly advised to upgrade to a patched version immediately. Marimo’s security policy states that security patches are provided for the latest stable release and encourages users to stay current.

This vulnerability is related to a separate flaw, CVE-2026-67618 (CVSS 7.1), also disclosed by VulnCheck on August 4, 2026, which involves an attacker-controlled AI base_url supplied through notebook metadata. Additionally, an earlier vulnerability, CVE-2026-39987, affected Marimo versions 0.20.4 and earlier, allowing a full pseudo-terminal (PTY) shell via the /terminal/ws endpoint; version 0.23.0 patched that issue.

Security experts recommend that organizations using Marimo notebooks review their deployments, apply the latest updates, and exercise caution when opening notebooks from untrusted sources.