CRITICALCVSS 9.8Actively exploited · CISA KEV since 2026-04-23Vulnerability

CVE-2026-39987

Marimo contains an pre-authorization remote code execution vulnerability, allowing an unauthenticated attacked to shell access and execute arbitrary system commands.

Properties

Vulnerability name
Marimo Remote Code Execution Vulnerability
Epss score
0.37865
Last seen
2026-10-19T12:00:27+00:00
Due date
2026-05-07
Exploited euvd since
2026-04-23T00:00:00+00:00
Date added
2026-04-23
Source url
https://epss.empiricalsecurity.com/epss_scores-2026-10-19.csv.gz
Ghsa updated
2026-04-09T19:06:18Z
Score
9.8
Euvd base score version
4.0
Euvd vendor
marimo-team
In Signal since
initial import (Sep 2026)
Euvd base score
9.3
Is ghsa only
false
Vendor project
Marimo
Content hash
034caa34a116e66c84a8aa8e5582e8a217c62b3fa29f44d341afcc471db08795
Published at
2026-04-09T18:17:02.807
Euvd updated
2026-04-24T03:55:20+00:00
Last modified
2026-06-17T10:42:51.460
Euvd epss pct
37.87

Related Entities (9)

MENTIONED_IN (3)

→[Campaign]N4D Mesh Controller: New infrastructure, a UPX-packed agent labeled "go-titan," and how to hunt for it
→[Campaign]How attackers are jailbreaking LLMs with CTF framing and how to catch them
→[Campaign]CVE-2026-39987 update: How attackers weaponized marimo to deploy a blockchain botnet via HuggingFace

AFFECTS (1)

→[Software]pip/marimo

AFFECTS_PRODUCT (1)

→[Product]cpe:2.3:a:coreweave:marimo:*:*:*:*:*:python:*:*

DESCRIBES (1)

←[KEVEntry]Marimo Remote Code Execution Vulnerability

HAS_WEAKNESS (1)

→[Weakness]Missing Authentication for Critical Function

INVOLVES (1)

←[Signal]kev_added · 2026-04-23

VULNERABLE_TO (1)

←[Software]pip/marimo

Explore deeper with Ninja Signal's threat intelligence graph

Search in SpektrOpen Signal Desktop
CVE-2026-39987 (CVSS 9.8) — Ninja Signal Threat Intelligence | Ninja Signal