LIVE FEED
FIRST LOOK GitHub Releases LLM Pre-Production Evaluation Guide for Developers // HIGH CVE-2026-75149: Marimo Notebook MCP Code Injection Flaw // FIRST LOOK AWS Adds Agentic Observability via OpenSearch Service MCP Apps // HIGH NVIDIA NemoClaw Flaw Lets Malicious Page Poison Local AI Model // HIGH AnonyMousKIT PhaaS Deploys Voice AI Agents to Steal iPhone Passcodes // HIGH Rogue AI Agents Escape Sandboxes to Launch Real Attacks // FIRST LOOK Flock Safety Launches OS Investigate AI for Law Enforcement // CRITICAL CVE-2025-62593: Ray AI Framework RCE via DNS Rebinding // FIRST LOOK AWS Launches AgentCore Gateway for AI Agent Tool Access Control // CRITICAL Grok Data Exfiltration via Cryptographic Context Injection //
ATLAS OWASP HIGH Significant risk · Prioritise patching LLM Security Agentic AI Supply Chain Research RELEVANCE ▲ 8.2

CVE-2026-75149: Marimo Notebook MCP Code Injection Flaw

SOURCE The Hacker News ↗
TL;DR HIGH
  • What happened: Crafted Marimo notebooks could silently execute attacker-controlled MCP commands on open.
  • Who's at risk: Data scientists and AI developers using Marimo notebooks prior to version 0.23.15 are directly exposed when opening untrusted notebooks in edit mode.
  • Act now: Upgrade Marimo to version 0.23.15 or later (current PyPI release is 0.24.0) · Treat all externally sourced notebooks as untrusted and review metadata before opening · Audit MCP server configurations and AI endpoint settings in existing notebooks for unexpected entries
CVE-2026-75149: Marimo Notebook MCP Code Injection Flaw

Overview

A high-severity code injection vulnerability tracked as CVE-2026-75149 has been patched in Marimo, the open-source reactive notebook environment widely used for AI and data science workflows. The flaw allowed a threat actor to embed a malicious Model Context Protocol (MCP) server command inside a specially crafted notebook file. When a victim opened the notebook in edit mode, the attacker-controlled command was launched as a local subprocess — before any notebook cell executed — giving the attacker immediate code execution with no authentication required.

The vulnerability was assigned a CVSS v4 score of 8.7 and a CVSS v3.1 score of 8.8. It affects all Marimo releases prior to version 0.23.15, which was published on July 23, 2026. The CVE was published by VulnCheck’s CNA on August 19, 2026. The current PyPI release as of August 25 is version 0.24.0.

Technical Analysis

Marimo notebooks store configuration metadata that can include AI provider settings, MCP server definitions, completion configurations, and secrets. Prior to the patch, this configuration was consumed without treating it as potentially attacker-controlled. A malicious actor could craft a notebook in which the mcp configuration section specified an arbitrary command string. When Marimo initialised the notebook environment in edit mode, it would launch that command as a local subprocess as part of MCP server startup — before any reactive cell in the notebook ran.

The attack vector is social engineering: distribute a crafted .py or notebook file to a target developer, data scientist, or AI researcher who opens it locally. No further interaction is needed once the file is opened in edit mode.

The patch, described as a PEP 723 hardening update, restructures Marimo’s handling of notebook metadata by assuming all notebook-supplied configuration is attacker-controlled. An allowlist approach is applied, and the following configuration sections are stripped if sourced from notebook metadata:

  • ai
  • mcp
  • completion
  • secrets
  • server

A related vulnerability, CVE-2026-67618 (CVSS 7.1, disclosed August 4, 2026), addressed a separate but adjacent trust boundary issue in the same configuration zone: an attacker-controlled base_url for AI providers could redirect an operator’s API key to an attacker-controlled endpoint when an AI request was made from the notebook.

A third, earlier flaw, CVE-2026-39987, involved a missing authentication check on Marimo’s /terminal/ws WebSocket endpoint that could yield a full PTY shell.

Framework Mapping

  • AML.T0081 (Modify AI Agent Configuration): The attack directly manipulates MCP server configuration embedded in notebook metadata to redirect execution.
  • AML.T0110 (AI Agent Tool Poisoning): The MCP command functions as a poisoned tool invocation within the AI-enabled notebook agent context.
  • AML.T0083 (Credentials from AI Agent Configuration): CVE-2026-67618, the companion flaw, targets API key exfiltration via manipulated AI configuration — a credential harvesting pattern.
  • LLM07 (Insecure Plugin Design): MCP server integration lacked input validation and trust boundary enforcement.
  • LLM08 (Excessive Agency): The notebook runtime granted subprocess execution authority to configuration values without user confirmation.

Impact Assessment

AI developers, data scientists, and ML researchers who use Marimo for interactive notebook workflows and who open externally sourced notebooks are the primary risk population. The impact is local arbitrary code execution with the privileges of the user running Marimo. Supply chain scenarios — malicious notebooks distributed via GitHub, package repositories, or shared workspaces — represent a credible delivery mechanism.

Mitigation & Recommendations

  1. Upgrade immediately to Marimo 0.23.15 or later. Version 0.24.0 is the current stable release on PyPI.
  2. Treat all externally sourced notebooks as untrusted — inspect metadata sections before opening in edit mode.
  3. Audit existing notebooks for unexpected mcp, ai, or server configuration blocks.
  4. Follow Marimo’s security policy, which provides patches for the latest stable release only.

References

◉ AI THREAT BRIEFING

Stay ahead of the threat.

Twice-weekly digest of critical AI security developments — every story mapped to MITRE ATLAS and OWASP LLM Top 10. Free.

No spam. Unsubscribe anytime.