{"data":{"id":"ea5ec13a-298a-468e-920a-453da5030edc","title":"CVE-2026-39987: Marimo Remote Code Execution Vulnerability","summary":"CVE-2026-39987 is a pre-authorization remote code execution vulnerability in Marimo. An unauthenticated attacker can gain shell access and execute arbitrary system commands. The vulnerability is actively exploited in the wild, per CISA KEV.","solution":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Due date: 2026-05-07.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-39987","publishedAt":"2026-04-23T00:00:00.000Z","cveId":"CVE-2026-39987","cweIds":["CWE-306"],"cvssScore":null,"cvssSeverity":null,"severity":"critical","attackType":["other"],"issueType":"vulnerability","affectedPackages":["marimo@< 0.23.0 (fixed: 0.23.0)"],"affectedPackageNames":["marimo"],"affectedPackageRefs":["pypi:marimo"],"affectedVendors":[],"affectedVendorsRaw":["Marimo"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":null,"headlinePromptVersion":"h1","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"active","epssScore":0.99743,"epssCheckedAt":"2026-11-11T00:13:31.078Z","kevDateAdded":"2026-04-23","advisoryAliases":["GHSA-2679-6mx9-h9xc"],"affectedPackagesSource":"ghsa","affectedPackagesCheckedAt":"2026-10-10T03:49:20.986Z","patchAvailable":true,"disclosureDate":"2026-04-23T00:00:00.000Z","fixReleasedAt":"2026-04-08T17:28:42.773Z","daysToFix":-15,"fixCheckedAt":"2026-10-29T21:37:42.728Z","capecIds":["CAPEC-115"],"crossRefCount":0,"attackSophistication":"trivial","impactType":["confidentiality","integrity","availability"],"aiComponentTargeted":"framework","llmSpecific":false,"classifierConfidence":0.8,"researchCategory":null,"atlasIds":null,"fixes":[{"ecosystem":"pypi","name":"marimo","fixedVersion":"0.23.0","matchedVersion":"0.23.0","fixReleasedAt":"2026-04-08T17:28:42.773Z","daysToFix":-15,"match":"ecosystem","source":"tracked","status":"found","checkedAt":"2026-10-29T21:37:42.582Z"}]}}