CVE-2026-39987 – Marimo Remote Code Execution

Marimo addressed CVE-2026-39987, a critical vulnerability that allows remote code execution within its platform. The issue impacts how user input or workflows are processed, enabling attackers to execute arbitrary code and potentially gain full control over the host system and associated environments.

CVE-2026-39987 has a CVSS score of 9.3, which is Critical severity. Active exploitation has been observed, confirming real-world attacks are already underway. The patch fixes the execution pathway and strengthens input validation to prevent further compromise.