Affected Systems
Marimo notebook software versions prior to 0.23.15. Vulnerability (CVE-2026-75149) affects users who open untrusted notebooks in edit mode. Fixed in version 0.23.15 (July 23, 2026); current release is 0.24.0.
Exploitation Status
No evidence of active exploitation reported. Vulnerability disclosed August 19, 2026. Researcher Gregory Tan credited with discovery and contributed to the hardening patch. Proof-of-concept details available in CVE record.
Business Impact
Attackers can inject malicious Model Context Protocol (MCP) server commands into notebook configuration metadata. When a victim opens the crafted notebook in edit mode, the attacker-controlled command executes as a local subprocess before any notebook cell runs, bypassing typical execution safeguards. CVSS v3.1: 8.8, CVSS v4: 8.7. Requires user interaction but no authentication. Risk is highest in environments where users routinely open notebooks from untrusted sources (shared repositories, public datasets, collaborative workflows).
Urgency
🟠Within 24 hours
Recommended Actions
- Upgrade Marimo to version 0.23.15 or later (current stable: 0.24.0) immediately on all systems running affected versions.
- Audit notebook sources: restrict opening notebooks to trusted repositories and implement code review for externally sourced .marimo files.
- Review subprocess and network activity logs from systems running Marimo versions prior to 0.23.15 for unexpected MCP server connections or command execution between July and August 2026.
- Implement application allowlisting or sandboxing for Marimo notebook environments to limit subprocess execution capabilities.
- Educate data science and development teams on the risks of opening untrusted notebooks and enforce organizational policies for notebook provenance verification.