The interactive notebook Marimo has patched a high-severity vulnerability CVE-2026-75149 that allowed an attacker to inject an arbitrary Model Context Protocol (MCP) command via the configuration of a specially crafted notebook. When such a notebook was opened in edit mode, the command was launched as a local subprocess — even before any code cell was executed. The vulnerability affects all Marimo versions prior to 0.23.15 and is fixed in that release. Users need to upgrade to at least version 0.23.15, and preferably to the current version 0.24.0.
Technical details of the vulnerability
According to the CVE entry in the OSV database, the vulnerability is classified as code injection. VulnCheck, acting as the CNA, assigned it a score of CVSS v4 8.7 and CVSS v3.1 8.8. Exploitation requires user interaction (opening a malicious notebook), but no attacker authentication is needed.
The attack mechanism works as follows: a specially crafted notebook contains in its metadata an MCP server configuration with an arbitrary command. When the victim opens this notebook in edit mode, the specified command is launched as a local subprocess — and this happens before any notebook cell is executed. This means that even a cautious user who does not run code manually is compromised simply by opening the file.
The CVE was published on August 19, 2026. Discovery of the vulnerability is attributed to researcher Gregory Tan (Grg0rry), who is also listed as a co-author of the fixing commit.
Fix approach: treating metadata as untrusted input
The key architectural decision in the PEP 723 patch is that notebook metadata is now treated as potentially attacker-controlled. All configuration coming from the notebook is passed through an allowlist. The following configuration sections are forcibly removed on load:
- ai — AI integration settings
- mcp — MCP server configuration
- completion — autocompletion parameters
- secrets — secrets and keys
- server — server settings
The patch includes a regression test that uses an attacker-controlled URL and verifies that the mcp section is indeed removed from the loaded configuration.
Related vulnerabilities: a systemic metadata trust issue
CVE-2026-75149 is not an isolated case. The same trust boundary around configuration sourced from notebook metadata was involved in a separate vulnerability, CVE-2026-67618 (CVSS 7.1), disclosed by VulnCheck on August 4, 2026. In that case, the attacker used notebook metadata to substitute a malicious AI service address (base_url). When the operator later sent a request to the AI, their API key was transmitted to an attacker-controlled server — again without any need to execute notebook cells. Both vulnerabilities affect versions prior to 0.23.15.
Another vulnerability had previously been found in Marimo — CVE-2026-39987, related to the lack of authentication on the /terminal/ws endpoint. According to the official Marimo advisory, requests to this endpoint allowed obtaining a full pseudo-terminal shell (PTY) and executing arbitrary commands. This issue affected versions 0.20.4 and earlier and was fixed in version 0.23.0.
Three vulnerabilities in a relatively short period point to a systemic problem: Marimo initially did not treat notebook files and their metadata as potentially hostile input. This is a common mistake for tools originally designed for local use that later end up in collaborative and distributed scenarios, where notebooks may come from untrusted sources.
Impact assessment
The highest risk is to data practitioners and developers who use Marimo for collaboration or receive notebooks from external sources — repositories, forums, training materials. Simply opening a malicious file in edit mode is enough for compromise: the attacker gains the ability to execute arbitrary code in the context of the local user without any visible warnings.
Recommendations
- Update Marimo to version 0.23.15 or later. The current version on PyPI is 0.24.0 (released August 17, 2026).
- Check your current version with the command
pip show marimo. - Do not open notebooks from untrusted sources in edit mode until you have upgraded.
- Audit metadata of notebooks received from external sources — check for the presence of
mcp,ai,server,secretssections in the configuration before opening. - According to the Marimo security policy, patches are released only for the latest stable release — keeping your installation up to date is critical.
The three Marimo vulnerabilities fixed in versions 0.23.0 and 0.23.15 demonstrate that the interactive notebook format is not just a document but a potential attack vector. The only reliable action is to immediately update to version 0.24.0 and to revise team notebook-sharing practices with the understanding that a notebook file may contain malicious configuration that triggers without explicit code execution.
