Marimo Patches High-Severity RCE Flaw in MCP Notebook Integration
A vulnerability in the reactive Python notebook allowed attackers to execute local subprocesses simply by opening a malicious file in edit mode.
Marimo has patched a high-severity security vulnerability that allowed for remote code execution (RCE) via the Model Context Protocol (MCP). The flaw enabled attackers to compromise a user's system by distributing a specially crafted notebook file.
According to reports from The Hacker News, the vulnerability allowed an attacker-supplied MCP command to run as a local subprocess on the victim's machine. Crucially, this execution occurred the moment a notebook was opened in edit mode, triggering the malicious command before any of the actual notebook cells were executed. This behavior bypassed the typical user expectation that code in a notebook only runs when a cell is explicitly triggered.
The MCP Integration Gap
Marimo is a reactive notebook for Python designed to integrate with the Model Context Protocol, a standard that allows AI models to interact with local tools and data. The security gap stemmed from how the notebook handled MCP configurations and commands during the initialization of the edit mode interface. By embedding a malicious command within the notebook's configuration, an attacker could force the application to spawn a subprocess with the privileges of the user running the notebook.
Implications for Data Science
This vulnerability represents a critical risk because it transforms a common collaborative practice—sharing notebooks—into a primary attack vector. Data scientists and developers frequently exchange `.ipynb` or Marimo-specific files to share research and code. Because the exploit triggers upon opening the file for editing rather than executing a cell, users who believe they are safely inspecting a file before running it remain vulnerable to system compromise or malware distribution.
Current Status and Remediation
The flaw is tracked by VulnCheck's CVE Numbering Authority (CNA) as CVE-2026-75149. Marimo has since released a patch to address the initialization logic and prevent the unauthorized execution of MCP commands. Users are urged to update to the latest version of the software immediately to mitigate the risk. Security researchers continue to monitor the interaction between AI-driven protocols like MCP and local execution environments to prevent similar initialization-based exploits.