# CVE-2026-75149: marimo code injection in notebook configuration handler

Source: https://junglewise.ai/threats/cve-2026-75149-marimo-code-injection-in-notebook-configuration-handler  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-19. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-75149 · Severity: high · CVSS 8.8 · Published 2026-08-19

marimo is a Python notebook environment used for interactive data analysis and visualization. A vulnerability in versions before 0.23.15 allows attackers to execute arbitrary commands on a user's computer by crafting a malicious notebook file with specially modified configuration settings. Simply opening such a notebook in edit mode triggers the attack without requiring the user to run any code, potentially allowing installation of malware or theft of sensitive data.

## Quick answers

**Is CVE-2026-75149 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-75149 being exploited in the wild.

**How severe is CVE-2026-75149?** High severity, with a CVSS score of 8.8, published 19 August 2026.

**Which products and versions are affected?** marimo-team marimo before 0.23.15.

**Is there a fix for CVE-2026-75149?** A patch was published on 2026-07-23: Fix merged in PR #10281 with commit 1a21bd7 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-75149 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-75149?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a code injection flaw in marimo's notebook configuration handler that processes PEP 723 script metadata. The root cause lies in insufficient sanitization of MCP (Model Context Protocol) server entries during notebook deserialization. An attacker can embed arbitrary command payloads in a notebook's configuration, which are executed as local subprocess calls during notebook initialization in edit mode, before any notebook cells are parsed or executed. No authentication or user interaction beyond opening the notebook is required. The fix involves additional PEP 723 configuration sanitization and validation of allowed configuration keys (commit 1a21bd7, PR #10281).

## Affected products

- marimo-team marimo before 0.23.15

## Timeline

- 2026-08-19: disclosed
- 2026-07-23: patched: Fix merged in PR #10281 with commit 1a21bd7

## References

- [https://github.com/marimo-team/marimo/commit/1a21bd71e258438d2511136b5edacc94c08855f4](https://github.com/marimo-team/marimo/commit/1a21bd71e258438d2511136b5edacc94c08855f4)
- [https://github.com/marimo-team/marimo/pull/10281](https://github.com/marimo-team/marimo/pull/10281)