Marimo Remote Code Execution Vulnerability

PoC: CVE-2026-39987-Marimo-Preauth-RCE

Reproduction and root cause analysis of CVE-2026-39987 Marimo pre-auth WebSocket RCE in a local Docker lab.

PoC: CVE-2026-39987

CVE-2026-39987 — Marimo Pre-Authentication RCE

[POC] MAL-2025-6022 — CVE-2026-39987_POC

Marimo WS Preauth RCE

[POC] MAL-2025-6022 — CVE-2026-39987

Marimo Pre Authentication RCE

[POC] GHSA-8gj2-2cvc-6xx7 — CVE-2026-39987_PoC

A proof-of-concept for CVE-2026-39987

[POC] GHSA-8gj2-2cvc-6xx7 — CVE-2026-39987

CVE-2026-39987 poc

[POC] GHSA-8gj2-2cvc-6xx7 — CVE-2026-39987

Simple POC for CVE-2026-39987

[POC] GHSA-8gj2-2cvc-6xx7 — CVE-2026-39987

Marimo exploit prior to 0.23.0. Pre-Auth RCE vulnerability via websocket endpoint : /terminal/ws.

[POC] CVE-2026-39987 — CVE-2026-39987

CVE-2026-39987 - Draft

[POC] CVE-2026-39987 — CVE-2026-39987-POC

CVE-2026-39987 Exploitation Tool - Marimo < 0.23.0 Pre-Auth RCE (WebSocket)

[POC] CVE-2026-39987 — CVE-2026-39987-marimo-rce

CVE-2026-39987

[POC] CVE-2026-39987 — CVE-2026-39987

Marimo Pre-Auth RCE

PoC: CVE-2026-39987-POC-Marimo

CVE-2026-39987 POC Marimo

PoC: MARABUSE-

MARIMO RCE & NKABUSE EXPLOIT FRAMEWORK (CVE-2026-39987) - RE-WEAPONIZED - This framework exploits CVE-2026-39987, a critical Remote Code Execution (RCE) vulnerability in Marimo, a popular Python-based data visualization tool. Attackers actively exploit this flaw to deploy NKAbuse, a blockchain-based botnet malware.

PoC: CVE-2026-39987-Marimo-RCE

CVE-2026-39987 Exploit | by infrar3d

PoC: CVE-2026-39987-Marimo-RCE

CVE-2026-39987 Exploit | by infrar3d

PoC: CVE-2026-39987-PoC

CVE-2026-39987 Proof of Concept

PoC: CVE-2026-39987.py

This python script exploit the vulnerable marimo /terminal/ws endpoint and returns a interactive shell.

PoC: cve-2026-39987

CVE-2026-39987 PoC: Marimo<0.23.0 Pre-Auth Remote Code Execution via Terminal WebSocket Authentication Bypass

PoC: CVE-2026-39987-Poc

Proof of Concept (PoC) WebSocket client for CVE-2026-39987 (Marimo Pre-Auth RCE), intended for authorized security testing.

PoC: cohort-htb

HTB Cohort - SSRF, Marimo pre-auth RCE (CVE-2026-39987) y PackageKit privesc (CVE-2026-41651)

PoC: CVE-2026-39987

CVE-2026-39987 for marimo 0.20.4 PoC

PoC: CVE-2026-39987

marimo is a reactive Python notebook. Prior to 0.23.0, Marimo has a Pre-Auth RCE vulnerability

PoC: CVE-2026-39987

CVE-2026-39987: Marimo Python Notebook Pre-Auth RCE (CVSS 9.3). Python & Nmap NSE detection scripts. Missing authentication on /terminal/ws WebSocket endpoint gives attackers a full PTY shell without any credentials. Exploited in the wild within 10 hours of disclosure. Fixed in Marimo 0.23.0.

PoC: marimo_CVE-2026-39987_RCE_PoC

CVE-2026-39987 - Marimo < 0.23.0 Pre-Auth RCE (WebSocket) PoC de explotación - Conecta a /terminal/ws sin autenticación Author: Fevar54 Date: 2026-04-13 Severity: CRITICAL CVSS: 9.3

PoC: CVE-2026-39987

CVE-2026-39987