Executive Summary
Marimo fixed a high-severity flaw where a crafted notebook could run an attacker-supplied MCP command as a local subprocess when opened in edit mode.
What Happened
Marimo has addressed a high-severity security flaw in its notebook software that allowed an attacker to execute an attacker-supplied Model Context Protocol (MCP) command in a specially crafted notebook, according to VulnCheck's CVE Numbering Authority (CNA) record. The CNA record says the command can run as a local subprocess when the notebook is opened in edit mode. The vulnerability, tracked
Affected Products
- Marimo
Vulnerability / Attack Technique
Malicious notebook triggering MCP command execution
Technical Mechanism
As reported, opening the notebook launched an MCP command before any cell ran.
AI Security Category
LLM03:2025 Supply Chain
Part of the MCP Security topic.
Part of the AI Supply Chain and AI SBOM topic.
Relevant Frameworks
RealGround Analysis
MCP configurations are executable. RealGround analysis: opening untrusted notebooks is running untrusted code.
Recommended Controls
- Update Marimo
- Open untrusted notebooks in a sandbox
Related RealGround Service
AI Agent SBOM and LLM Mapping · or start with the free AI Agent Security Scanner.
Sources
thehackernews.com: https://thehackernews.com/2026/08/marimo-notebook-flaw-could-run-mcp.html
Summary and analysis written by RealGround from the source above; last updated 2026-10-18.