Marimo Notebook Flaw Could Run MCP Commands Before Cells Execute in Edit Mode
A high-severity security flaw in Marimo's notebook software allowed an attacker to execute an attacker-supplied Model Context Protocol (MCP) command in a specially crafted notebook. The vulnerability, tracked as CVE-2026-75149, affects versions prior to 0.23.15 and has be…
Intelligence analysis by Llama
Marimo's notebook software had a high-severity security flaw that allowed an attacker to execute an attacker-supplied MCP command in a specially crafted notebook. The vulnerability, CVE-2026-75149, has been addressed in version 0.23.15.
Imagine you have a special notebook that can do lots of things, like math and writing. But, if someone makes a special kind of notebook that can trick the computer, they might be able to make the computer do something it's not supposed to do. This is like a special kind of trick that can make the computer do something bad. Marimo, the company that makes the notebook, fixed this problem in a new version of the software.
Analysis
Vulnerability Overview
The vulnerability, tracked as CVE-2026-75149, is a code injection issue affecting versions prior to 0.23.15 of Marimo's notebook software. It allows an attacker to execute an attacker-supplied Model Context Protocol (MCP) command in a specially crafted notebook. The CNA record assigns it a CVSS v4 score of 8.7 and a CVSS v3.1 score of 8.8, with user interaction required and no attacker authentication required.
Impact
The vulnerability has a significant impact on users running affected releases, as it allows an attacker to execute malicious code. The CNA record says the specified command is launched as a local subprocess before any notebook cell is executed. This means that an attacker could potentially execute arbitrary code on a user's system, leading to a range of possible attacks, including data theft, system compromise, and more.
Patching
Marimo has addressed the issue in version 0.23.15. Users running an affected release should move to a version outside the affected range. The patch's MCP regression case uses an attacker-controlled URL and verifies that the mcp section is removed. The CNA record supplies the separate command-to-subprocess behavior described for CVE-2026-75149.
Related Flaws
The same configuration boundary was addressed in VulnCheck's separate CVE-2026-67618 advisory (CVSS score: 7.1), disclosed on August 4, 2026. That flaw affects Marimo versions before 0.23.15 and involves an attacker-controlled artificial intelligence (AI) base_url supplied through notebook metadata. For CVE-2026-67618, an operator opens the malicious notebook. The operator later makes an AI request. The configured endpoint then receives the operator's API key without requiring a notebook cell to be executed.
Key points
- Marimo's notebook software had a high-severity security flaw that allowed an attacker to execute an attacker-supplied MCP command in a specially crafted notebook.
- The vulnerability, tracked as CVE-2026-75149, affects versions prior to 0.23.15 and has been addressed in version 0.23.15.
- The CNA record assigns it a CVSS v4 score of 8.7 and a CVSS v3.1 score of 8.8, with user interaction required and no attacker authentication required.
- Marimo has addressed the issue in version 0.23.15, and users running an affected release should move to a version outside the affected range.
The fact that Marimo has addressed the issue in version 0.23.15 is a positive sign. It shows that the company is taking security seriously and is working to fix problems as they arise. This could lead to a more secure and trustworthy product for users.
The fact that the vulnerability was not caught earlier is a concern. It highlights the importance of regular security testing and patching. If users had not updated to the latest version, they may still be vulnerable to this attack.
