Executive Summary
In August 2026, Marimo addressed a critical code injection vulnerability (CVE-2026-75149) in its notebook software that allowed attackers to execute malicious Model Context Protocol (MCP) commands through specially crafted notebooks. The flaw, scoring 8.7-8.8 on CVSS scales, enabled arbitrary command execution as local subprocesses when victims opened malicious notebooks in edit mode, requiring no authentication but needing user interaction. Marimo patched the vulnerability in version 0.23.15 by implementing configuration allowlisting to treat notebook metadata as attacker-controlled content.
This incident highlights the growing security risks in AI development environments as organizations increasingly adopt notebook-based workflows for machine learning and data science projects. With the rise of collaborative AI development and shared notebook repositories, similar supply chain attacks targeting development tools are becoming more prevalent.
Why This Matters Now
AI development environments face increasing supply chain attacks as collaborative notebook sharing grows. Organizations must secure their ML development tools before attackers exploit trusted development workflows to compromise AI infrastructure and steal sensitive models or data.
Attack Path Analysis
An attacker crafted a malicious Marimo notebook containing attacker-controlled MCP server commands in the notebook configuration metadata. When a victim opened the notebook in edit mode, the MCP command executed automatically as a local subprocess before any notebook cells ran, providing initial code execution. The attacker could then escalate privileges through the spawned subprocess, move laterally within the local environment or connected cloud workloads, establish command and control channels, exfiltrate sensitive data from the notebook environment or connected systems, and potentially impact business operations through data theft or system compromise.
Kill Chain Progression
Initial Compromise
Description
Attacker crafts malicious Marimo notebook with attacker-controlled MCP server command in notebook configuration, which executes as local subprocess when victim opens notebook in edit mode
Related CVEs
CVE-2026-75149
CVSS 8.8A code injection vulnerability in Marimo notebook software allows attackers to execute arbitrary MCP commands through specially crafted notebooks when opened in edit mode.
Affected Products:
Marimo Marimo Notebook – < 0.23.15
Exploit Status:
proof of conceptCVE-2026-67618
CVSS 6.5An API key exfiltration vulnerability in Marimo notebook software allows attackers to steal API keys through malicious notebook metadata containing attacker-controlled AI base_url.
Affected Products:
Marimo Marimo Notebook – < 0.23.15
Exploit Status:
proof of concept
MITRE ATT&CK® Techniques
Command and Scripting Interpreter
Command and Scripting Interpreter: JavaScript
Phishing: Spearphishing Attachment
User Execution: Malicious File
Process Injection
Hide Artifacts: Hidden Files and Directories
Data from Local System
Potential Compliance Exposure
Mapping incident impact across multiple compliance frameworks.
PCI DSS 4.0 – Software Development Life Cycle
Control ID: 6.2.4
NYDFS 23 NYCRR 500 – Information Security Program
Control ID: 500.08
CISA ZTMM 2.0 – Secure Application Development
Control ID: Application Security
ISO 27001 – Secure Development Policy
Control ID: A.14.2.1
DORA – ICT Risk Management
Control ID: Article 9
Sector Implications
Industry-specific impact of the vulnerabilities, including operational, regulatory, and cloud security risks.
Computer Software/Engineering
Marimo notebook code injection vulnerability enables MCP command execution before cell execution, threatening development environments and software supply chains.
Higher Education/Acadamia
Educational institutions using Marimo notebooks face risks from CVE-2026-75149 allowing subprocess execution when students open malicious research notebooks.
Research Industry
Research organizations utilizing Marimo for data science workflows vulnerable to command injection attacks through crafted notebook metadata configurations.
Information Technology/IT
IT departments must address high-severity code injection flaw affecting Marimo notebook infrastructure, requiring immediate upgrade to version 0.23.15.
Sources
- Marimo Notebook Flaw Could Run MCP Commands Before Cells Execute in Edit Modehttps://thehackernews.com/2026/08/marimo-notebook-flaw-could-run-mcp.htmlVerified
- CVE-2026-75149 - OSV Vulnerability Databasehttps://osv.dev/vulnerability/CVE-2026-75149Verified
- Marimo PEP 723 Hardening Patchhttps://github.com/marimo-team/marimo/commit/1a21bd71e258438d2511136b5edacc94c08855f4Verified
- VulnCheck Advisory - Marimo API Key Exfiltrationhttps://www.vulncheck.com/advisories/marimo-api-key-exfiltration-via-malicious-notebook-pep-723-metadataVerified
Frequently Asked Questions
Cloud Native Security Fabric Mitigations and ControlsCNSF
Aviatrix Zero Trust CNSF would constrain this Marimo notebook attack by limiting the compromised environment's network reach and segmenting access to connected cloud workloads. The attacker's ability to move laterally and establish persistent communication channels would likely be significantly reduced through east-west traffic controls and egress policy enforcement.
Control: Cloud Native Security Fabric (CNSF)
Mitigation: The malicious subprocess would likely face restricted network connectivity and limited access to cloud resources through identity-aware access controls and workload-level security policies applied to the notebook environment.
Control: Zero Trust Segmentation
Mitigation: Privilege escalation attempts would likely be constrained to the isolated notebook workload segment, preventing broader access to cloud infrastructure and reducing the scope of potential system compromise through network-level isolation.
Control: East-West Traffic Security
Mitigation: Lateral movement attempts would likely be blocked or significantly constrained as east-west traffic controls would prevent unauthorized communication between the compromised notebook and other workloads or network segments.
Control: Multicloud Visibility & Control
Mitigation: Command and control communications would likely be detected and potentially blocked through comprehensive traffic monitoring and anomaly detection across the multicloud environment, reducing the attacker's ability to maintain persistent access.
Control: Egress Security & Policy Enforcement
Mitigation: Data exfiltration attempts would likely be constrained or blocked through egress filtering and policy enforcement that controls outbound data flows from the notebook environment to unauthorized external destinations.
The overall business impact would likely be significantly reduced as the attack scope would be contained to the isolated notebook workload, preventing broader infrastructure compromise and limiting data exposure to resources within the segmented environment.
Impact at a Glance
Affected Business Functions
- Data Science Operations
- AI/ML Development
- Research Computing
- Notebook-based Analytics
Estimated downtime: 1 days
Estimated loss: N/A
Potential exposure of API keys for AI services, local system access through arbitrary command execution, and compromise of notebook development environments containing proprietary data science models and algorithms
Recommended Actions
Key Takeaways & Next Steps
- • Implement Zero Trust segmentation to isolate notebook environments and prevent lateral movement to critical cloud workloads
- • Deploy egress security controls to detect and block unauthorized outbound communications from compromised notebook processes
- • Enable multicloud visibility and control to monitor anomalous interactions and suspicious automation from notebook environments
- • Enforce strict egress filtering policies to prevent data exfiltration through unauthorized channels from development environments
- • Deploy Cloud Native Security Fabric (CNSF) with real-time inspection capabilities to detect and block malicious code execution patterns in AI/ML workflows
