Marimo fixes edit-mode MCP command injection in crafted notebooks

Marimo has fixed a high-severity code-injection vulnerability, tracked as CVE-2026-75149, that could allow a crafted notebook to launch an attacker-supplied Model Context Protocol (MCP) command when opened in edit mode. The issue affects Marimo versions before 0.23.15 and has a CVSS v4 score of 8.7 and a CVSS v3.1 score of 8.8.

VulnCheck’s CVE Numbering Authority record states that the supplied command can be started as a local subprocess before any notebook cell is executed. Exploitation requires a victim to open the malicious notebook in edit mode, but does not require attacker authentication.

Notebook metadata became an execution boundary

OSV’s CVE import describes the attack path as an attacker-controlled MCP server command delivered through notebook configuration. Rather than relying on visible notebook code, the crafted metadata can cause the configured command to run when the file is opened for editing.

This makes the distinction between opening a notebook and executing its cells materially important. The reported behavior occurs before a user runs notebook content, so users assessing a shared file only in edit mode could still trigger the local subprocess behavior described in the CVE record.

Patch removes notebook-supplied settings

Marimo addressed the issue in version 0.23.15, published on July 23, 2026. Its PEP 723 hardening change treats notebook metadata as attacker-controlled and routes notebook-supplied configuration through an allowlist. The patch removes the ai, mcp, completion, secrets and server configuration sections supplied by a notebook.

The MCP regression test uses an attacker-controlled URL and verifies that the mcp section is removed. The current PyPI release was version 0.24.0 as of August 25, following the publication of the CVE on August 19.

Related issues reinforce the metadata risk

The same configuration boundary was also involved in CVE-2026-67618, a separate vulnerability with a CVSS score of 7.1. In that case, attacker-controlled AI base_url metadata could receive an operator’s API key after the operator opened a malicious notebook and later made an AI request, without executing a notebook cell.

Marimo identifies CVE-2026-75149 as separate from CVE-2026-39987, an earlier issue affecting version 0.20.4 and earlier through missing authentication validation on the /terminal/ws endpoint. Marimo lists version 0.23.0 as the fix for that endpoint flaw.

For organisations using Marimo, the practical implication is to move affected installations to version 0.23.15 or later, keep the latest stable release deployed, and handle notebooks received from outside the organisation as untrusted content even when no cells are run.