CVE-2026-39987

Remote Code Execution in Marimo. CISA confirmed attackers exploit it and added it to its Known Exploited Vulnerabilities catalog on 23 April 2026.

Product: Marimo
Added to CISA's catalog: 23 April 2026
Federal fix-by date: 7 May 2026
Ransomware: No known use in ransomware campaigns
Vendor advisories: github.com/marimo-team/marimo/security/advisories/GHSA-2679-6mx9-h9xc
Sources: CISA’s catalog, NVD entry

CISA’s description.

Marimo contains an pre-authorization remote code execution vulnerability, allowing an unauthenticated attacked to shell access and execute arbitrary system commands.

Every flaw CISA confirmed exploited in the last 30 days is on the exploit watch. This is not security advice. Check the vendor’s advisory before acting. From CISA’s catalog of 4 November 2026.