---
title: "[AUTO] Marimo notebooks execute code just by opening them"
pubDatetime: 2026-08-25T21:34:00.000Z
description: "Code injection in marimo notebooks runs arbitrary MCP commands on file open, no execution required."
tags: [vulnerability, ai-security, mcp, supply-chain, 2026, 2026-q3, 2026-08, AUTO]
---
marimo versions before 0.23.15 contain a code injection vulnerability that executes attacker-supplied commands the moment you open a crafted notebook file in edit mode, with no cells executed and no authentication required. A malicious MCP server entry embedded in the notebook's configuration [triggers the attack automatically](https://www.vulncheck.com/advisories/marimo-code-injection-via-mcp-server-configuration).

The flaw (CVE-2026-75149, CVSS 8.7) was patched in version 0.23.15 on July 23, but the CVE wasn't published until August 19, creating a window where organizations might run vulnerable code without knowing the risk exists. The low-friction attack surface makes this a real supply-chain problem for notebooks shared internally or pulled from repositories.

What makes this notably worse than typical notebook-based code injection: there's no execution step required. You don't need to run a cell. Just opening the file in edit mode is enough. That's the whole threat model, a single file share, no user participation beyond a file open.

Marimo addressed this in 0.23.15 by treating notebook metadata as untrusted and filtering dangerous MCP configuration sections. If you're using marimo, update. If you're sharing notebooks, review what versions collaborators are running.

---

*Sources: [VulnCheck CVE advisory](https://www.vulncheck.com/advisories/marimo-code-injection-via-mcp-server-configuration)  •  [marimo Security Documentation](https://docs.marimo.io/security/)*

*Coverage: [The Hacker News](https://thehackernews.com/2026/08/marimo-notebook-flaw-could-run-mcp.html)*

*Related on this blog: [[AUTO] MCP's Secret Problem Isn't the Bugs](/posts/auto-mcp-secrets)  •  [[AUTO] Fragmented Instructions Bypass Agent Safeguards](/posts/auto-ghostsplice-fragmentation)  •  [[AUTO] NPM Supply Chain Trojan Commodifies Post-Exploitation With Embedded LLM C2](/posts/auto-redc2-npm-supply-chain)*