CVE-2026-39987 PoC — marimo Affected by Pre-Auth Remote Code Execution via Terminal WebSocket Authentication Bypass

Source

https://github.com/projectdiscovery/nuclei-templates/blob/main/javascript/cves/2026/CVE-2026-39987.yaml

Associated Vulnerability

Title: marimo Affected by Pre-Auth Remote Code Execution via Terminal WebSocket Authentication Bypass (CVE-2026-39987)
Description:marimo is a reactive Python notebook. Prior to 0.23.0, Marimo has a Pre-Auth RCE vulnerability. The terminal WebSocket endpoint /terminal/ws lacks authentication validation, allowing an unauthenticated attacker to obtain a full PTY shell and execute arbitrary system commands. Unlike other WebSocket endpoints (e.g., /ws) that correctly call validate_auth() for authentication, the /terminal/ws endpoint only checks the running mode and platform support before accepting connections, completely skipping authentication verification. This vulnerability is fixed in 0.23.0.

Description

Marimo versions <= 0.20.4 contain an unauthenticated remote code execution vulnerability. The terminal WebSocket endpoint /terminal/ws lacks authentication validation, allowing an unauthenticated attacker to connect via WebSocket, obtain a full PTY shell, and execute arbitrary OS commands on the underlying server.

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →