CVE-2026-75149: marimo < 0.23.15 Code Injection via MCP Server Configuration
marimo before 0.23.15 contains a code injection vulnerability in the notebook configuration handler that allows attackers to execute arbitrary commands by supplying a crafted MCP server entry with an attacker-controlled command value embedded in a notebook. When the notebook is opened in edit mode, marimo launches the specified command as a local subprocess before any notebook cell is executed, requiring no authentication or cell execution to trigger the vulnerability.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
marimoto a version that resolves this vulnerability.Fixed in 0.23.15
Event History
Frequently Asked Questions
Who is exposed to this issue?
Users running marimo versions earlier than 0.23.15 are exposed when they open a notebook containing a crafted MCP server configuration in edit mode. The command runs locally in the context of the user launching marimo.
What must an attacker provide to trigger exploitation?
The attacker needs to supply a notebook with an MCP server entry whose command value they control. Convincing a user to open that notebook in edit mode triggers the subprocess launch.
Does a user need to run a notebook cell for the attack to work?
No. The crafted command is launched before any notebook cell is executed, and the issue does not require authentication.
What should be done if an immediate upgrade is not possible?
Do not open untrusted notebooks in edit mode on affected versions, particularly notebooks that may contain MCP server configuration entries. Upgrade marimo to version 0.23.15 or later when possible.