Marimo Notebook Flaw Could Run MCP Commands Before Cells Execute in Edit Mode
Marimo notebook software contained a high-severity code injection vulnerability (CVE-2026-75149, CVSS 8.8) allowing attacker-supplied MCP commands to execute as local subprocesses before any notebook cell runs The flaw affects all Marimo versions prior to 0.23.15 and requires only user interaction (opening the notebook in edit mode) with no attacker authentication needed Marimo patched the issue through a PEP 723 hardening patch that treats notebook metadata as untrusted and removes dangerous co
Analysis
TL;DR
- Marimo notebook software contained a high-severity code injection vulnerability (CVE-2026-75149, CVSS 8.8) allowing attacker-supplied MCP commands to execute as local subprocesses before any notebook cell runs
- The flaw affects all Marimo versions prior to 0.23.15 and requires only user interaction (opening the notebook in edit mode) with no attacker authentication needed
- Marimo patched the issue through a PEP 723 hardening patch that treats notebook metadata as untrusted and removes dangerous configuration sections (ai, mcp, completion, secrets, server) via allowlist filtering
- The same configuration boundary was previously exploited in CVE-2026-67618 (CVSS 7.1), which allowed attacker-controlled AI base_url to steal API keys without cell execution
- Gregory Tan (Grg0rry) discovered the vulnerability and also co-authored the hardening commit; the fix was included in version 0.23.15 (July 23, 2026)
Why It Matters
This vulnerability highlights a critical attack surface in AI notebook ecosystems where malicious notebooks can execute arbitrary code before any user interaction beyond opening the file. As Model Context Protocol (MCP) adoption grows across AI tooling, similar injection vectors could emerge in other platforms that trust notebook metadata. The incident underscores the importance of treating all externally-sourced notebook configurations as potentially hostile and implementing strict allowlist-based filtering.
Technical Details
- Vulnerability Type: Code injection via notebook metadata, specifically through the MCP (Model Context Protocol) configuration section in notebook JSON
- Attack Vector: A specially crafted notebook embeds an attacker-controlled MCP server command in its metadata; when opened in edit mode, Marimo launches this command as a local subprocess before executing any cells
- Affected Versions: All Marimo releases prior to 0.23.15; the current stable release as of August 2026 is 0.24.0
- CVSS Scores: CVSS v3.1 score of 8.8 (High); CVSS v4 score of 8.7 (High); requires user interaction but no authentication
- Patch Approach: Marimo's PEP 723 hardening patch removes five notebook-supplied configuration sections (ai, mcp, completion, secrets, server) and passes remaining configuration through a strict allowlist, treating all notebook metadata as attacker-controlled
- Related Vulnerabilities: CVE-2026-67618 (CVSS 7.1) addressed a similar boundary issue with AI base_url injection; CVE-2026-39987 (patched in 0.23.0) involved missing authentication on the /terminal/ws endpoint allowing PTY shell access
Industry Insight
- Notebook Security Must Evolve Beyond Cell Execution: Traditional notebook security models focus on code execution within cells, but this vulnerability demonstrates that metadata parsing alone can become an arbitrary code execution vector—security frameworks need to harden all input surfaces, not just executable content
- MCP Ecosystem Security Is an Emerging Priority: As MCP becomes a standard protocol for connecting AI models to tools and data sources, the attack surface for protocol-level injection in notebook and IDE contexts will expand; developers should adopt zero-trust principles for all MCP configuration sources
- Rapid Patching Cycles Are Essential for AI Tooling: Marimo released the fix within weeks of the earlier related CVE, but the existence of multiple vulnerabilities in the same configuration boundary suggests that security audits should comprehensively review all metadata parsing paths rather than patching individual issues in isolation
Disclaimer: The above content is generated by AI and is for reference only.