Marimo has fixed a high-severity issue in its notebook software that could allow an attacker to trigger a Model Context Protocol (MCP) command through a specially crafted notebook. According to the CVE record maintained by VulnCheck’s CVE Numbering Authority (CNA), the problem is triggered when the notebook is opened in edit mode, before any notebook cell runs.
The vulnerability is tracked as CVE-2026-75149. It is classified as a code injection issue affecting Marimo versions earlier than 0.23.15. In short: if you open an attacker-prepared notebook while editing, the notebook may launch a local subprocess based on attacker-controlled MCP configuration or commands.
What the Marimo Notebook vulnerability allows
The CNA record describes a scenario where a crafted notebook can supply an attacker-controlled MCP server command through notebook configuration. When a victim opens the notebook in edit mode, the specified command can be executed as a local subprocess before any cell is executed.
That timing detail matters. Many users assume that harmful behavior would only happen after they run or execute content. Here, the CVE documentation indicates the dangerous action can occur earlier—during the edit-mode opening process.
Key details: CVE-2026-75149 severity and conditions
For CVE-2026-75149, the CNA assigns a CVSS v4 score of 8.7 and a CVSS v3.1 score of 8.8. The record also states that user interaction is required, while the attacker does not need authentication.
- User interaction required: the victim must open the notebook, specifically in edit mode.
- No attacker authentication needed: the exploit relies on the crafted notebook content and configuration.
- Affected versions: Marimo versions before 0.23.15.
The CVE was published on August 19, and Marimo addressed the issue in version 0.23.15.
What changed in the patch
Marimo’s mitigation is described as hardening that treats notebook metadata as attacker-controlled. Instead of trusting configuration that comes from the notebook itself, the fix routes notebook-supplied configuration through an allowlist—and removes specific configuration sections that could otherwise be used to steer behavior.
In the described patch, these notebook-supplied configuration sections are removed:
- ai
- mcp
- completion
- secrets
- server
In addition, the MCP regression test referenced in the record uses an attacker-controlled URL and verifies that the mcp section is removed. The CNA record also separately highlights the command-to-subprocess behavior tied to CVE-2026-75149.
Why edit mode is the triggering point
The vulnerability does not rely on a user explicitly running a notebook cell. Instead, it leverages the application behavior that happens when opening a notebook in edit mode. The CNA record indicates that the configured command is launched as a local subprocess before any notebook cell executes.
This is a meaningful difference for risk assessment. If you only execute cells in a separate workflow (or assume that “no execution” means “no risk”), this issue suggests that the notebook opening process itself can be the risk boundary—at least for affected versions.
Update guidance: move to 0.23.15 or later
Marimo has addressed the issue in version 0.23.15. Users running affected releases are advised to upgrade to a version outside the affected range.
At the time the reporting was confirmed, the Hacker News noted that the current PyPI release was 0.24.0, released on August 17. Marimo’s 0.23.15 release was published earlier, on July 23, 2026.
Marimo’s stated security approach emphasizes that security patches are provided for the latest stable release, and it encourages users to stay up to date.
Related security history: another notebook boundary issue
This MCP-related CVE is not the only Marimo notebook boundary problem discussed recently. The source reporting distinguishes CVE-2026-75149 from an earlier issue tracked as CVE-2026-39987, which involved a missing authentication validation on the /terminal/ws endpoint.
For CVE-2026-39987, Marimo’s advisory states that versions 0.20.4 and earlier were affected. Requests to that endpoint could obtain a full pseudo-terminal (PTY) shell, enabling execution of arbitrary commands. Marimo lists 0.23.0 as the patched version for that earlier flaw.
Another CVE with a similar theme: attacker-controlled AI configuration
The reporting also references a separate advisory, CVE-2026-67618, disclosed on August 4, 2026. While it is described separately from CVE-2026-75149, it addresses a similar boundary: notebook-supplied configuration that could steer behavior in ways the application should not allow.
For CVE-2026-67618, the CNA assigns a CVSS score of 7.1 (as referenced in the source). The issue involves an attacker-controlled AI base_url supplied through notebook metadata. The described flow is:
- An operator opens the malicious notebook.
- The operator later makes an AI request.
- The configured endpoint receives the operator’s API key, without requiring a notebook cell to be executed.
That earlier pattern reinforces why the patch approach—treating notebook metadata as attacker-controlled and stripping or restricting certain sections—matters beyond a single MCP scenario.
Who discovered CVE-2026-75149
The CVE record credits Gregory Tan, using the handle Grg0rry, with discovering the flaw. The same handle also appears as a co-author on Marimo’s PEP 723 hardening commit mentioned in the source reporting.
Practical steps to reduce risk
If you use Marimo for notebooks that may be received from others—or if you collaborate with people outside your direct trust boundary—treat opening an unknown notebook in edit mode as a potentially risky action on affected versions.
- Upgrade immediately: install Marimo 0.23.15 or later.
- Be cautious with unknown notebooks: especially before you verify the source.
- Reassess trust in notebook metadata: the patch shows metadata can be attacker-controlled in this threat model.
Bottom line
The Marimo Notebook vulnerability tracked as CVE-2026-75149 shows how notebook opening workflows can become an attack surface. In affected versions, a crafted notebook opened in edit mode may launch attacker-influenced MCP commands as a local subprocess before cells execute. The fix is available in 0.23.15, and upgrading to the latest stable release is the most direct way to reduce exposure.
Source: https://thehackernews.com/2026/08/marimo-notebook-flaw-could-run-mcp.html
