Marimo Security Update Advisory (CVE-2026-39987)
Overview.
an authentication bypass remote code execution vulnerability (CVE-2026-39987) has been reported in marimo.
the vulnerability is a pre-authentication (Pre-Auth) vulnerability that allows remote code execution without authorization via bypassing Terminal WebSocket authentication.
Affected versions and scope.
affected versions are reported to be marimo 0.20.4 and earlier.
systems and services using the affected software may be at risk.
Attack technique and impact.
threat actors may be able to bypass the Terminal WebSocket authentication mechanism and attempt to remotely execute arbitrary code execution.
remote code execution could result in serious security impacts, including gaining system control, data exfiltration, and additional malware.
Resolution and recommended action.
the vulnerability has been patched in MARIMO 0.23.0 according to the official security advisory.
affected versions should be updated to the latest version of the patch.
before and after updating, you should check the changelog and security advisories.
Note.
please refer to the official security advisory document and the GitHub Advisory (GHSA-2679-6mx9-h9xc) for detailed impact and patch information.