Vulnerabilities4 min read
Marimo RCE Exploited 10 Hours After Disclosure—CISA Adds to KEV
CVE-2026-39987 in Marimo Python notebooks allows unauthenticated RCE via terminal WebSocket. Attackers weaponized it within hours. Patch to 0.23.0 now.
Marcus ChenApr 11, 2026