Full Report
Marimo has addressed a high-severity security flaw in its notebook software that allowed an attacker to execute an attacker-supplied Model Context Protocol (MCP) command in a specially crafted notebook, according to VulnCheck's CVE Numbering Authority (CNA) record. The CNA record says the command can run as a local subprocess when the notebook is opened in edit mode. The vulnerability, tracked
Analysis Summary
# Vulnerability: Arbitrary Command Execution via Malicious MCP Metadata in Marimo Notebooks
## CVE Details
- **CVE ID:** CVE-2026-75149
- **CVSS Score:** 8.8 (v3.1) / 8.7 (v4.0) (High)
- **CWE:** Code Injection (Improper Input Validation of PEP 723 metadata)
## Affected Systems
- **Products:** Marimo notebook software
- **Versions:** All versions prior to 0.23.15
- **Configurations:** The vulnerability is triggered when a notebook is opened in **edit mode**.
## Vulnerability Description
The flaw stems from the improper handling of notebook configuration metadata. Marimo notebooks allowed attackers to supply Model Context Protocol (MCP) server commands within the notebook's metadata (specifically configuration sections).
When a victim opens a specially crafted notebook in edit mode, the software launches the attacker-specified MCP command as a local subprocess. This execution occurs **automatically** upon opening the file, before any notebook cells are manually executed by the user. This bypasses the typical security expectation that code only runs when a cell is explicitly triggered.
## Exploitation
- **Status:** PoC availability confirmed (regression test cases available in vendor commits).
- **Complexity:** Low (Requires only a crafted notebook file).
- **Attack Vector:** Local (Triggered by opening a malicious file locally).
- **User Interaction:** Required (Victim must open the malicious notebook in edit mode).
## Impact
- **Confidentiality:** High (Potential for full system access/data exfiltration).
- **Integrity:** High (Attacker can run arbitrary local subprocesses).
- **Availability:** High (Attacker can execute commands to disrupt the local system).
## Remediation
### Patches
- **Upgrade to Marimo version 0.23.15 or later.**
- The current stable release as of late August 2026 is **0.24.0**.
- The fix implements an allowlist for notebook metadata and strips out dangerous sections including `ai`, `mcp`, `completion`, `secrets`, and `server`.
### Workarounds
- Do not open Marimo notebooks from untrusted or unverified sources in "Edit Mode."
- Review the raw text/JSON of a notebook for suspicious `mcp` or `server` metadata before opening it in the Marimo interface.
## Detection
- **Indicators of Compromise:** Unusual subprocesses spawned by the Marimo parent process, particularly those related to network tools (curl, wget) or shells (sh, bash, powershell) immediately upon opening a file.
- **Detection Methods:** Audit notebook files for a configuration block containing `mcp` server commands or unexpected URLs in the PEP 723 metadata section.
## References
- **Vendor Advisory/Patch:** [hXXps://github[.]com/marimo-team/marimo/commit/1a21bd71e258438d2511136b5edacc94c08855f4]
- **OSV Record:** [hXXps://osv[.]dev/vulnerability/CVE-2026-75149]
- **Related Vulnerability (AI exfiltration):** CVE-2026-67618
- **News Source:** [hXXps://thehackernews[.]com/2026/08/marimo-notebook-flaw-could-run-mcp.html]