{"id":2524,"date":"2026-08-25T16:10:52","date_gmt":"2026-08-25T16:10:52","guid":{"rendered":"https:\/\/thedigitalfortress.us\/?p=2524"},"modified":"2026-08-25T16:10:52","modified_gmt":"2026-08-25T16:10:52","slug":"marimo-notebook-flaw-could-run-mcp-commands-before-cells-execute-in-edit-mode","status":"publish","type":"post","link":"https:\/\/thedigitalfortress.us\/?p=2524","title":{"rendered":"Marimo Notebook Flaw Could Run MCP Commands Before Cells Execute in Edit Mode"},"content":{"rendered":"
\n

\ue804<\/i>Swati Khandelwal<\/span>\ue802<\/i>Aug 25, 2026<\/span><\/span>Vulnerability \/ AI Security<\/span><\/p>\n<\/div>\n

\n
<\/a><\/div>\n

Marimo has addressed a high-severity security flaw in its notebook software that allowed an attacker to execute an attacker-supplied Model Context Protocol (MCP) command in a specially crafted notebook, according to VulnCheck’s CVE Numbering Authority (CNA) record.<\/p>\n

The CNA record says the command can run as a local subprocess when the notebook is opened in edit mode.<\/p>\n

The vulnerability, tracked as CVE-2026-75149<\/strong>, is a code injection issue affecting versions prior to 0.23.15. VulnCheck’s CVE Numbering Authority (CNA) record assigns it a CVSS v4 score of 8.7 and a CVSS v3.1 score of 8.8, with user interaction required and no attacker authentication required.<\/p>\n

Marimo has addressed the issue in version 0.23.15. The CVE was published on August 19. Users running an affected release should move to a version outside the affected range.<\/p>\n

According to OSV’s CVE import<\/a>, a crafted notebook can supply an attacker-controlled MCP server command through notebook configuration.<\/p>\n

\n
\"Cybersecurity\"<\/a><\/div>\n<\/div>\n

The victim opens the notebook in edit mode. The CNA record says the specified command is launched as a local subprocess before any notebook cell is executed.<\/p>\n

<\/p>\n

Marimo’s PEP 723 hardening patch<\/a> treats notebook metadata as attacker-controlled and passes notebook-supplied configuration through an allowlist.<\/p>\n

The following notebook-supplied configuration sections are removed –<\/p>\n