marimo versions before 0.23.15 contain a code injection vulnerability that executes attacker-supplied commands the moment you open a crafted notebook file in edit mode, with no cells executed and no authentication required. A malicious MCP server entry embedded in the notebook’s configuration triggers the attack automatically.
The flaw (CVE-2026-75149, CVSS 8.7) was patched in version 0.23.15 on July 23, but the CVE wasn’t published until August 19, creating a window where organizations might run vulnerable code without knowing the risk exists. The low-friction attack surface makes this a real supply-chain problem for notebooks shared internally or pulled from repositories.
What makes this notably worse than typical notebook-based code injection: there’s no execution step required. You don’t need to run a cell. Just opening the file in edit mode is enough. That’s the whole threat model, a single file share, no user participation beyond a file open.
Marimo addressed this in 0.23.15 by treating notebook metadata as untrusted and filtering dangerous MCP configuration sections. If you’re using marimo, update. If you’re sharing notebooks, review what versions collaborators are running.
Sources: VulnCheck CVE advisory • marimo Security Documentation
Coverage: The Hacker News
Related on this blog: [AUTO] MCP’s Secret Problem Isn’t the Bugs • [AUTO] Fragmented Instructions Bypass Agent Safeguards • [AUTO] NPM Supply Chain Trojan Commodifies Post-Exploitation With Embedded LLM C2