What happened
Marimo contains an pre-authorization remote code execution vulnerability, allowing an unauthenticated attacked to shell access and execute arbitrary system commands.
Affected versions
Marimo: See original advisory Fixed: See vendor advisory.
Why it matters
This source correlation may provide earlier visibility while structured CVE metadata is still being updated.
Detection & mitigation
- Review the original advisory and validate affected versions.
- Apply vendor-provided updates or mitigations when available.
Public PoC references
RepositoryAuthorFirst seenReference
Exploit-DB 52673Marimo 0.20.4 - RCEJason Bernier2026-09-02VerifiedGhxstsec/CVE-2026-39987★ 1Ghxstsec2026-09-01VerifiedClara-M-Grossl/Exploit-Marimo Marimo Pre-Auth RCE (CVE-2026–39987)★ 0Clara-M-Grossl2026-08-27Candidatedodeepsink/CVE-2026-39987.pyThis python script exploit the vulnerable marimo /terminal/ws endpoint and returns a interactive shell.★ 0dodeepsink2026-08-20VerifiedK3ysTr0K3R/CVE-2026-39987CVE-2026-39987 — Marimo Pre-Authentication RCE★ 1K3ysTr0K3R2026-08-19Verifiedmatesz44/cve-2026-39987CVE-2026-39987 PoC: Marimo<0.23.0 Pre-Auth Remote Code Execution via Terminal WebSocket Authentication Bypass★ 0matesz442026-08-12VerifiedMADA0L/CVE-2026-39987-PocProof of Concept (PoC) WebSocket client for CVE-2026-39987 (Marimo Pre-Auth RCE), intended for authorized security testing.★ 0MADA0L2026-08-10VerifiedalreadyClosed/CVE-2026-39987CVE-2026-39987 for marimo 0.20.4 PoC★ 0alreadyClosed2026-08-07Verifiedjasonbernier/CVE-2026-39987Simple POC for CVE-2026-39987★ 0jasonbernier2026-08-02VerifiedWind010/CVE-2026-39987_PoCA proof-of-concept for CVE-2026-39987★ 1Wind0102026-08-03Verifiedvanhari/CVE-2026-39987CVE-2026-39987 poc★ 0vanhari2026-08-02VerifiedSource timeline
Discovered through CISA Known Exploited VulnerabilitiesView source ↗
Added to CISA Known Exploited Vulnerabilities catalogView source ↗
Added to CISA Known Exploited Vulnerabilities catalogView source ↗
Added to CISA Known Exploited Vulnerabilities catalogView source ↗
Added to CISA Known Exploited Vulnerabilities catalogView source ↗
Added to CISA Known Exploited Vulnerabilities catalogView source ↗
Added to CISA Known Exploited Vulnerabilities catalogView source ↗
Added to CISA Known Exploited Vulnerabilities catalogView source ↗
Added to CISA Known Exploited Vulnerabilities catalogView source ↗
Added to CISA Known Exploited Vulnerabilities catalogView source ↗
Added to CISA Known Exploited Vulnerabilities catalogView source ↗
Record history
Record created from the first normalized source observation.
Metadata and source references refreshed.