marimo Affected by Pre-Auth Remote Code Execution via Terminal WebSocket Authentication Bypass

marimo is a reactive Python notebook. Prior to 0.23.0, Marimo has a Pre-Auth RCE vulnerability. The terminal WebSocket endpoint /terminal/ws lacks authentication validation, allowing an unauthenticated attacker to obtain a full PTY shell and execute arbitrary system commands. Unlike other WebSocket endpoints (e.g., /ws) that correctly call validate_auth() for authentication, the /terminal/ws endpoint only checks the running mode and platform support before accepting connections, completely skipping authentication verification. This vulnerability is fixed in 0.23.0.

N/A

关键功能的认证机制缺失

marimo 访问控制错误漏洞

marimo是marimo开源的一个交互式Python笔记本，支持响应式编程和SQL查询。 marimo 0.23.0之前版本存在访问控制错误漏洞，该漏洞源于终端WebSocket端点缺少身份验证，可能导致未经身份验证的攻击者获得完整PTY shell并执行任意系统命令。

N/A

N/A