Critical Marimo RCE Flaw Lets Attackers Run Remote Code

Key Takeaways

• A critical pre-authentication remote code execution (RCE) flaw (CVE-2026-39987) has been discovered in the Marimo Python notebook framework.
• The vulnerability affects Marimo versions 0.22.x and earlier, specifically due to a missing authentication check in the /terminal/ws WebSocket endpoint.
• Attackers are actively exploiting this flaw to deploy NKAbuse malware, leveraging legitimate platforms like Hugging Face Spaces for payload delivery.
• A patch is available; users are strongly advised to upgrade to Marimo 0.23.0 or later immediately.

Critical RCE Flaw in Marimo Python Framework Under Active Exploitation

A severe security vulnerability within the Marimo Python notebook framework is currently being exploited in the wild. This critical flaw allows attackers to achieve pre-authentication remote code execution (RCE), granting them complete control over affected systems without needing credentials.

Designated as CVE-2026-39987, the vulnerability originates from an oversight in authentication enforcement on a specific WebSocket terminal endpoint. This lapse permits unauthorized users to establish system-level shells directly, bypassing any login requirements.

Cybersecurity researchers have issued warnings that this vulnerability is already being weaponized. Threat actors are leveraging it to distribute NKAbuse malware, with the malicious payloads hosted on Hugging Face Spaces. This platform, increasingly popular for sharing AI tools and machine learning applications, is becoming a convenient distribution channel for attackers.

Technical Deep Dive into Marimo Vulnerability

The security issue impacts Marimo versions up to and including 0.22.x, specifically concerning the /terminal/ws WebSocket endpoint. Due to inadequate access control mechanisms, this endpoint accepts unauthenticated connections and directly initiates a pseudo-terminal (PTY) session utilizing pty.fork().

Unlike other sensitive endpoints within the framework, /terminal/ws lacks the necessary authentication enforcement, creating a significant security loophole. The core problem lies in the absence of access control checks within the WebSocket handler code, as illustrated:

@router.websocket("/terminal/ws")
async def websocket_endpoint(websocket: WebSocket) -> None:
    await websocket.accept()
    child_pid, fd = pty.fork() # Spawns system shell

Upon successful connection, attackers gain interactive shell access, enabling them to execute arbitrary commands on the host system. Marimo is widely adopted as a contemporary alternative to Jupyter Notebooks for various applications, including AI and machine learning prototyping, data science experiments, internal analytics dashboards, and research and engineering workflows.

These environments frequently operate within containers or cloud infrastructure, often possessing access to sensitive resources such as API keys, databases, and internal services. Given that Marimo executes live Python code and interacts directly with the underlying system, exploitation of this flaw inevitably leads to immediate and complete compromise.

Exploitation is straightforward and does not require any prior authentication, as detailed by Resecurity. A basic Python exploit involves:

• Connecting to ws://target:2718/terminal/ws.
• The server accepting the connection without validating identity.
• A PTY-backed shell being spawned on the system.
• The attacker executing commands like whoami or id, or running data-extraction scripts.

This effectively transforms the vulnerable Marimo instance into a remotely accessible command-line interface.

Threat actors are currently exploiting this vulnerability to deliver NKAbuse malware, retrieving payloads from repositories hosted on Hugging Face. This trend underscores how legitimate AI development platforms are being co-opted for malicious purposes, allowing nefarious activities to blend seamlessly with normal developer operations.

Successful exploitation can lead to severe consequences, including:

• Full system compromise via pre-authentication RCE.
• Exposure of sensitive data, such as .env files, API keys, and credentials.
• Lateral movement across internal networks.
• Establishment of persistence through cron jobs or startup scripts.
• Container escape or host-level compromise in misconfigured environments.
• Theft of proprietary AI models and datasets.

Since Marimo instances are often deployed within trusted network segments, a single breach can rapidly escalate into a broader infrastructure incident. The vulnerability stems from an inconsistent WebSocket security model within Marimo, where the /ws endpoint is properly protected, but the /terminal/ws endpoint lacks authentication checks. This discrepancy creates an authentication bypass, exposing critical functionality directly to attackers.

What You Should Do

• Upgrade Immediately: All users should upgrade their Marimo installations to version 0.23.0 or later without delay.
• Limit Exposure: Avoid exposing Marimo instances directly to public networks.
• Implement Access Controls: Restrict access to Marimo instances using VPNs or authenticated reverse proxies.
• Principle of Least Privilege: Run containers as non-root users and apply the principle of least privilege to limit potential damage from compromise.
• Secure Sensitive Data: Regularly rotate secrets and ensure sensitive data is not stored directly within notebook environments.
• Monitor for Anomalies: Implement monitoring for suspicious WebSocket activity and unusual shell spawning behavior on systems running Marimo.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.