Marimo, the open-source notebook platform, has patched a critical vulnerability that permitted execution of attacker-specified Model Context Protocol (MCP) commands before any notebook cell runs — simply when a notebook is opened in edit mode. This flaw, tracked as CVE-2026-75149, impacts all versions prior to 0.23.15 and carries a high severity rating. Users are strongly urged to upgrade to Marimo 0.23.15 or above immediately.
The Vulnerability & Its Risks
The flaw arises when a maliciously crafted notebook includes specially manipulated metadata. As soon as such a notebook is opened in edit mode, an MCP server command controlled by the attacker is launched locally as a subprocess—before any regular notebook cell is executed. Because the issue is triggered simply by opening the notebook in edit view and requires no special user authentication, it makes for a highly dangerous attack vector. The vulnerability scores 8.7 under CVSS v4 and 8.8 under CVSS v3.1, reflecting its severity.
Patch & Prevention
The fix arrives in version 0.23.15, which implements a hardening measure under PEP 723. Central to the correction is treating all notebook metadata as potentially malicious, followed by applying an allowlist that removes several configuration sections supplied by notebooks — including ai, mcp, completion, secrets, and server. This change ensures that configuration meant to manipulate MCP behavior no longer has unintended effects.
Marimo’s most current PyPI release is version 0.24.0, published on August 17, 2026, which includes the security fixes from 0.23.15. For full protection, users still running versions earlier than 0.23.15 must upgrade. Marimo’s security policy supports only the latest stable release, reinforcing the need to stay current.
Context & Related Flaws
This bug adds to a growing list of MCP-metadata issues in Marimo. CVE-2026-67618, also addressed in version 0.23.15, involved an attacker-controlled AI base_url supplied via notebook metadata, which could leak sensitive API keys when an AI request was made. Earlier still was CVE-2026-39987, a flaw in versions up to 0.20.4, where authentication was missing on the /terminal/ws endpoint—allowing remote shell access and arbitrary code execution.
The discoverer of CVE-2026-75149 is credited to researcher Gregory Tan (Grg0rry); the same individual co-authored the commit implementing the PEP 723 hardening patch. The patch suite removes risky metadata sections and adds regression tests to verify that notebook configurations can no longer inject malicious MCP commands.
Bottom line: If you use Marimo notebooks, any version below 0.23.15 is vulnerable. The severity, ease of exploitation, and the fact that this bug executes code before cell execution make it especially dangerous.
What to Watch Going Forward
Organizations using Marimo — especially those running untrusted notebooks — should audit their systems for versions < 0.23.15, upgrade immediately, and monitor notebook metadata practices closely. Developers should treat metadata handling as critical, applying allowlists wherever external configuration is involved. As notebook platforms become more prevalent in AI workloads, this kind of early-execution vulnerability may become more common. Successful mitigation depends on proactive patching and stricter boundaries on what metadata a notebook can supply.
