A critical pre-authentication RCE vulnerability (CVE-2026-39987) in marimo, an open-source reactive Python notebook, was exploited in the wild just 9 hours and 41 minutes after its advisory was published — with no public proof-of-concept code available. The Sysdig Threat Research Team captured the full attack chain via honeypots: an attacker connected to the unauthenticated `/terminal/ws` WebSocket endpoint, validated code execution, performed manual reconnaissance, and completed a credential theft operation (harvesting AWS keys and secrets from `.env` files) in under 3 minutes. The case highlights that niche software with small user bases is not safer from exploitation, that advisory detail alone is sufficient to build working exploits, and that the median time-to-exploit has collapsed to hours. Defenders are advised to update to marimo 0.23.0 immediately, rotate exposed credentials, restrict network access to the terminal endpoint, and extend advisory monitoring beyond CVE databases.
