CVE-2026-75149: marimo code injection

CISO Take

marimo, a Python notebook tool popular in AI/ML workflows, will launch any command specified in a notebook's MCP server configuration as a local subprocess the moment the notebook is opened in edit mode — before the user runs a single cell and without any authentication. Because the trigger is opening a file rather than executing code, this turns notebook sharing (a routine practice in ML teams, research collaboration, and open-source repos) into a full remote code execution vector with a CVSS of 8.8 and no privileges required. There is no CISA KEV listing, no EPSS score, and no public exploit or scanner template yet, but the low attack complexity and trivial crafting effort (a single JSON/TOML entry in the notebook file) mean weaponization is straightforward once attackers notice AI notebook tools as a soft target. Patch to marimo 0.23.15 or later immediately, and until then treat any marimo notebook received from outside your organization (GitHub, email, Slack, model cards, tutorials) as untrusted and inspect its MCP server entries before opening it in edit mode. Detection teams should watch for unexpected child processes spawned by the marimo edit-mode process shortly after a notebook file is opened.

Sources:NVDGitHub AdvisoryATLAS

What is the risk?

High risk despite the absence of active exploitation signals: the vulnerability requires no authentication and no privileges, has low attack complexity, and yields full compromise of confidentiality, integrity, and availability (CVSS 3.1: 8.8). The only mitigating factor in the CVSS vector is the User Interaction requirement — a victim must open the crafted notebook in edit mode — but this is a routine, low-friction action for developers and researchers who regularly open notebooks from colleagues, GitHub repos, or shared research artifacts. Given marimo's growing adoption as an AI/ML notebook environment with native MCP (Model Context Protocol) integration, the attack surface intersects directly with AI tool supply chains. The lack of a public exploit, EPSS score, or KEV listing suggests exploitation has not yet been observed in the wild, but the simplicity of the trigger (a single malicious config field, no code execution needed inside a cell) makes this an attractive, low-effort weaponization target.

How does the attack unfold?

Weaponization

Attacker crafts a marimo notebook file embedding a malicious command inside an MCP server configuration entry.

AML.T0011.000

Delivery

The poisoned notebook is distributed via a public repo, tutorial, or shared research artifact and opened by a victim in marimo edit mode.

AML.T0011

Execution

marimo parses the notebook configuration and launches the attacker-controlled command as a local subprocess before any cell runs.

AML.T0050

Impact

Attacker achieves arbitrary code execution with the victim's privileges, enabling credential theft, data access, or lateral movement into connected AI infrastructure.

Weaponization

Attacker crafts a marimo notebook file embedding a malicious command inside an MCP server configuration entry.

AML.T0011.000

Delivery

The poisoned notebook is distributed via a public repo, tutorial, or shared research artifact and opened by a victim in marimo edit mode.

AML.T0011

Execution

marimo parses the notebook configuration and launches the attacker-controlled command as a local subprocess before any cell runs.

AML.T0050

Impact

Attacker achieves arbitrary code execution with the victim's privileges, enabling credential theft, data access, or lateral movement into connected AI infrastructure.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
marimo	—	—	No patch

Do you use marimo? You're affected.

How severe is it?

CVSS 3.1

8.8 / 10

EPSS

1.0%

chance of exploitation in 30 days

Higher than 62% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AVNetwork

ACLow

PRNone

UIRequired

SUnchanged

CHigh

IHigh

AHigh

What should I do?

1 step

Upgrade to marimo 0.23.15 or later immediately, which contains the fix (see GitHub commit 1a21bd7 and release 0.23.15). Until patched, do not open marimo notebooks in edit mode from untrusted or unverified sources — treat notebook files with the same suspicion as executable attachments. Review notebook files for embedded MCP server configuration entries before opening them, specifically looking for unexpected or unfamiliar command values. Where feasible, open untrusted notebooks in an isolated VM or container with no access to credentials or sensitive network resources. For detection, monitor for subprocess creation by the marimo edit-mode process immediately following notebook load, and alert on any child process spawned by marimo that does not match a known, allow-listed MCP server binary.

What does CISA's SSVC say?

DecisionTrack

Exploitationnone

AutomatableNo

Technical Impacttotal

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Code ExecutionSupply ChainAgentPluginAML.T0011- User Execution AML.T0011.000- Unsafe AI Artifacts AML.T0050- Command and Scripting Interpreter AML.T0081- Modify AI Agent Configuration

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15-Accuracy, robustness and cybersecurity

NIST AI RMF

MANAGE 4.1-Post-deployment AI risk monitoring and response

OWASP LLM Top 10

LLM03-Supply Chain VulnerabilitiesLLM06-Excessive Agency

Frequently Asked Questions

What is CVE-2026-75149?

marimo, a Python notebook tool popular in AI/ML workflows, will launch any command specified in a notebook's MCP server configuration as a local subprocess the moment the notebook is opened in edit mode — before the user runs a single cell and without any authentication. Because the trigger is opening a file rather than executing code, this turns notebook sharing (a routine practice in ML teams, research collaboration, and open-source repos) into a full remote code execution vector with a CVSS of 8.8 and no privileges required. There is no CISA KEV listing, no EPSS score, and no public exploit or scanner template yet, but the low attack complexity and trivial crafting effort (a single JSON/TOML entry in the notebook file) mean weaponization is straightforward once attackers notice AI notebook tools as a soft target. Patch to marimo 0.23.15 or later immediately, and until then treat any marimo notebook received from outside your organization (GitHub, email, Slack, model cards, tutorials) as untrusted and inspect its MCP server entries before opening it in edit mode. Detection teams should watch for unexpected child processes spawned by the marimo edit-mode process shortly after a notebook file is opened.

Is CVE-2026-75149 actively exploited?

No confirmed active exploitation of CVE-2026-75149 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-75149?

Upgrade to marimo 0.23.15 or later immediately, which contains the fix (see GitHub commit 1a21bd7 and release 0.23.15). Until patched, do not open marimo notebooks in edit mode from untrusted or unverified sources — treat notebook files with the same suspicion as executable attachments. Review notebook files for embedded MCP server configuration entries before opening them, specifically looking for unexpected or unfamiliar `command` values. Where feasible, open untrusted notebooks in an isolated VM or container with no access to credentials or sensitive network resources. For detection, monitor for subprocess creation by the marimo edit-mode process immediately following notebook load, and alert on any child process spawned by marimo that does not match a known, allow-listed MCP server binary.

What systems are affected by CVE-2026-75149?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, notebook/development environments, MCP tool integrations.

What is the CVSS score for CVE-2026-75149?

CVE-2026-75149 has a CVSS v3.1 base score of 8.8 (HIGH). The EPSS exploitation probability is 0.96%.

What is the AI security impact?

Affected AI Architectures

agent frameworksnotebook/development environmentsMCP tool integrations

MITRE ATLAS Techniques

AML.T0011User Execution

AML.T0011.000Unsafe AI Artifacts

AML.T0050Command and Scripting Interpreter

AML.T0081Modify AI Agent Configuration

Compliance Controls Affected

EU AI Act: Article 15

NIST AI RMF: MANAGE 4.1

OWASP LLM Top 10: LLM03, LLM06

What are the technical details?

Original Advisory

marimo before 0.23.15 contains a code injection vulnerability in the notebook configuration handler that allows attackers to execute arbitrary commands by supplying a crafted MCP server entry with an attacker-controlled command value embedded in a notebook. When the notebook is opened in edit mode, marimo launches the specified command as a local subprocess before any notebook cell is executed, requiring no authentication or cell execution to trigger the vulnerability.

Exploitation Scenario

An attacker publishes a marimo notebook to a public GitHub repository, package registry, or research-sharing platform (e.g., disguised as an AI agent tutorial or a useful data analysis template) with an MCP server entry whose `command` field points to a malicious script or reverse shell payload. A developer or researcher, evaluating the notebook, clones it and opens it in marimo's edit mode to inspect the code. Before viewing or running any cell, marimo parses the notebook's configuration and launches the attacker's command as a local subprocess, granting the attacker code execution with the victim's privileges — enabling credential theft, lateral movement into connected AI infrastructure (API keys, model endpoints, vector databases), or persistence on the developer's machine.

Weaknesses (CWE)

CWE-94Improper Control of Generation of CodePrimary CWE-94Improper Control of Generation of Code

CWE-94 — Improper Control of Generation of Code: The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

[Architecture and Design] Refactor your program so that you do not have to dynamically generate code.
[Architecture and Design] Run your code in a "jail" or similar sandbox environment that enforces strict boundaries between the process and the operating system. This may effectively restrict which code can be executed by your product. Examples include the Unix chroot jail and AppArmor. In general, managed code may provide some protection. This may not be a feasible solution, and it only limits the impact to the operating system; the rest of your application may still be subject to compromise. Be careful to avoid CWE-243 and other weaknesses related to jails.

Source: MITRE CWE corpus.