---
title: "Marimo OSS Python Notebook RCE: From Disclosure to Exploitation in Under 10 Hours"
url: https://daily.dev/posts/marimo-oss-python-notebook-rce-from-disclosure-to-exploitation-in-under-10-hours-vdh0nxkfq
source_url: https://webflow.sysdig.com/blog/marimo-oss-python-notebook-rce-from-disclosure-to-exploitation-in-under-10-hours
type: article
source: "Sysdig Blog"
published: 2026-05-31T07:44:06.327Z
updated: 2026-05-31T09:13:15.011Z
tags: ["security", "python"]
reading_time: 10
upvotes: 0
comments: 0
language: en
---

> ## Documentation Index
> Fetch the complete documentation index at: https://daily.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Marimo OSS Python Notebook RCE: From Disclosure to Exploitation in Under 10 Hours

**[Sysdig Blog](https://daily.dev/sources/sysdig-blog)** · 10 min read · 0 upvotes · 0 comments

## Summary

A critical pre-authentication RCE vulnerability (CVE-2026-39987) in marimo, an open-source reactive Python notebook, was exploited in the wild just 9 hours and 41 minutes after its advisory was published — with no public proof-of-concept code available. The Sysdig Threat Research Team captured the full attack chain via honeypots: an attacker connected to the unauthenticated `/terminal/ws` WebSocket endpoint, validated code execution, performed manual reconnaissance, and completed a credential theft operation (harvesting AWS keys and secrets from `.env` files) in under 3 minutes. The case highlights that niche software with small user bases is not safer from exploitation, that advisory detail alone is sufficient to build working exploits, and that the median time-to-exploit has collapsed to hours. Defenders are advised to update to marimo 0.23.0 immediately, rotate exposed credentials, restrict network access to the terminal endpoint, and extend advisory monitoring beyond CVE databases.

## Full article

daily.dev links to this article rather than hosting it. Read it at the original source: <https://webflow.sysdig.com/blog/marimo-oss-python-notebook-rce-from-disclosure-to-exploitation-in-under-10-hours>

## Similar posts on daily.dev

- [Hackers exploit Marimo flaw to deploy NKAbuse malware from Hugging Face](https://daily.dev/posts/hackers-exploit-marimo-flaw-to-deploy-nkabuse-malware-from-hugging-face-kw5u2gmr6) · BleepingComputer · 2 upvotes · 0 comments

---

Tags: [#security](https://daily.dev/tags/security), [#python](https://daily.dev/tags/python)

[View this post on daily.dev](https://daily.dev/posts/marimo-oss-python-notebook-rce-from-disclosure-to-exploitation-in-under-10-hours-vdh0nxkfq)