Marimo Notebook Flaw Could Run MCP Commands Before Cells Execute in Edit Mode
- ID
- 17657
- Status
- summarized
- Published
- 25 Aug 2026, 8:43 PM
- Fetched
- 25 Aug 2026, 10:42 PM
- Provider
- The Hacker News
- Category
- security
- Original URL
- https://thehackernews.com/2026/08/marimo-notebook-flaw-could-run-mcp.html
- Source URL
- https://feeds.feedburner.com/TheHackersNews
Summary
- Score
- 6.0
- Created
- 25 Aug 2026, 10:42 PM
- Tags
- Audience
- developersai_ml_learners
What happened
Marimo notebooks prior to version 0.23.15 had a code injection flaw (CVE-2026-75149, CVSS 8.7/8.8) where a crafted notebook could supply an attacker-controlled MCP server command through notebook configuration that runs as a local subprocess when the victim opens the notebook in edit mode—before any cell executes. Marimo patched this in 0.23.15 by treating notebook metadata as attacker-controlled and passing config through an allowlist, stripping the ai, mcp, completion, secrets, and server sections. Current PyPI release is 0.24.0.
Why it matters
If you or your team use Marimo notebooks, update to at least 0.23.15 immediately—opening a shared or untrusted notebook in edit mode could have silently launched arbitrary local subprocesses via MCP config. Anyone distributing Marimo notebooks for demos, tutorials, or collaboration should verify recipients are on a patched version, since the attack requires only that the victim opens the file.
Discussion angle
The broader pattern: notebook files are now a vector for MCP server configuration injection, not just code execution—how should teams handle shared notebooks the same way they handle untrusted scripts?