Marimo RCE Flaw CVE-2026-39987 Exploited Within 10 Hours of Disclosure

A critical RCE vulnerability in Marimo Python notebook was exploited within 10 hours of disclosure, demonstrating rapid weaponization of newly disclosed flaws.

• •CVE-2026-39987 (CVSS 9.3) affects Marimo versions prior to 0.23.0, lacking authentication on the /terminal/ws WebSocket endpoint
• •Attackers gain full PTY shell access and can execute arbitrary system commands without credentials
• •Sysdig observed first exploitation 9 hours 41 minutes after disclosure, with credential theft operations conducted within minutes
• •The threat actor manually explored the system, attempted to harvest data from .env files, and searched for SSH keys
• •The rapid exploitation highlights that threat actors actively monitor vulnerability disclosures and exploit them quickly, affecting any internet-facing application regardless of popularity