CVE-2026-75149: marimo Code Injection RCE Vulnerability

CVE-2026-75149 Overview

CVE-2026-75149 is a code injection vulnerability in marimo versions prior to 0.23.15. The flaw resides in the notebook configuration handler, which processes Model Context Protocol (MCP) server entries embedded in notebook metadata. An attacker can craft a notebook that specifies an arbitrary command as an MCP server value. When a victim opens the notebook in edit mode, marimo launches the attacker-controlled command as a local subprocess before any cell executes. The vulnerability requires no authentication and no cell execution to trigger, only user interaction to open the notebook. The issue is tracked under CWE-94: Improper Control of Generation of Code.

Critical Impact
Opening a malicious marimo notebook in edit mode triggers arbitrary command execution on the local host with the privileges of the marimo process.

Affected Products

marimo versions prior to 0.23.15
Notebooks processed by the marimo edit-mode handler
Environments that open untrusted .py marimo notebooks containing PEP 723 script metadata

Discovery Timeline

2026-08-19 - CVE CVE-2026-75149 published to NVD
2026-08-19 - Last updated in NVD database

Technical Details for CVE-2026-75149

Vulnerability Analysis

The vulnerability stems from insufficient sanitization of PEP 723 inline script metadata inside marimo notebooks. Marimo reads a pyproject-style configuration block embedded in the notebook and applies user-supplied values to runtime configuration, including MCP server definitions. MCP server entries accept a command field that marimo passes to a subprocess launcher.

Because the sanitizer allowed attacker-controlled keys to reach the configuration merge, a crafted notebook could inject an MCP server whose command executes arbitrary local binaries. The subprocess is launched during the edit-mode initialization path, prior to notebook cell evaluation, so the victim never needs to run any code for the payload to execute.

Root Cause

The root cause is a missing allowlist on script-metadata configuration keys. The prior sanitizer returned early when an intermediate key path was missing, effectively skipping downstream sanitization for sibling keys, and it did not restrict which top-level keys could be honored from script metadata. Attacker-supplied MCP configuration therefore reached the runtime without being filtered.

Attack Vector

An attacker distributes a marimo notebook file containing crafted PEP 723 metadata. Delivery vectors include shared repositories, email attachments, or public notebook galleries. When the victim opens the notebook in marimo edit mode, the configuration handler parses the metadata, registers the malicious MCP server, and spawns the attacker's command as a child process of the marimo runtime.

python

# Security patch in marimo/_config/reader.py
# Source: https://github.com/marimo-team/marimo/commit/1a21bd71e258438d2511136b5edacc94c08855f4
"""Sanitize the pyproject.toml dictionary by removing specified keys."""
for key_path in keys:
    current_level = pyproject_dict
    missing_intermediate = False
    for key in key_path[:-1]:
        if key in current_level and isinstance(current_level[key], dict):
            current_level = current_level[key]
        else:
            missing_intermediate = True
            break
    if missing_intermediate:
        continue
    if current_level and key_path[-1] in current_level:
        LOGGER.warning(
            "%s in script metadata is ignored for security reasons",

The patch replaces the early return with a continue, ensuring the sanitizer processes all key paths instead of aborting when one intermediate key is missing. A companion change in marimo/_config/manager.py introduces ALLOWED_SCRIPT_CONFIG_TOP_KEYS and an allowlist_script_config helper to constrain which configuration keys can be sourced from script metadata.

Detection Methods for CVE-2026-75149

Indicators of Compromise

Unexpected child processes spawned by the marimo process shortly after a notebook is opened in edit mode.
Notebooks containing PEP 723 metadata blocks that define mcp or mcpServers entries with a command field pointing to shells, interpreters, or network utilities.
Outbound network connections initiated by processes whose parent is marimo edit.

Detection Strategies

Inspect .py notebooks for embedded # /// script PEP 723 blocks that reference MCP server configuration or arbitrary command values.
Monitor endpoint process trees for subprocesses of the marimo interpreter that are not part of a legitimate cell execution.
Alert on marimo installations reporting a version lower than 0.23.15 via software inventory scans.

Monitoring Recommendations

Enable process-creation logging on developer workstations and correlate parent-child relationships with the marimo binary.
Log and review DNS and outbound connections from Python interpreters running marimo notebooks from untrusted sources.
Track file writes to user home directories and scheduled task registrations that follow a marimo notebook open event.

How to Mitigate CVE-2026-75149

Immediate Actions Required

Upgrade marimo to version 0.23.15 or later on all developer and analyst workstations.
Audit existing marimo notebooks from untrusted sources for PEP 723 metadata that references MCP server configuration.
Restrict edit-mode use of marimo to trusted notebooks until the upgrade is deployed.

Patch Information

The fix is delivered in the marimo 0.23.15 release via pull request #10281 and commit 1a21bd7. The patch adds ALLOWED_SCRIPT_CONFIG_TOP_KEYS, an allowlist_script_config helper, and corrects the sanitizer loop so all disallowed keys are stripped from script metadata. Additional context is available in the VulnCheck advisory for marimo.

Workarounds

Do not open marimo notebooks from untrusted or unverified sources in edit mode.
Review notebooks with a plain text editor before opening in marimo, and remove any embedded PEP 723 script metadata blocks that define MCP server entries.
Run marimo inside a sandboxed environment such as a container or restricted user account to limit the impact of a successful exploit.

bash

# Upgrade marimo to the patched release
pip install --upgrade "marimo>=0.23.15"

# Verify the installed version
marimo --version

# Inspect a notebook for embedded PEP 723 script metadata before opening
grep -nE '^# /// script|mcp|mcpServers|command' path/to/notebook.py