A critical pre-authentication remote code execution vulnerability in Marimo, an open-source Python notebook platform owned by AI cloud company CoreWeave, was exploited in the wild less than 10 hours ...

As indicated by a warning message, the authentication in the context of the WebSocket endpoint /terminal/ws is broken, and attackers can exploit the “critical” vulnerability (CVE-2026-39987) without ...

Hackers started exploiting a critical vulnerability in the Marimo open-source reactive Python notebook platform just 10 hours after its public disclosure. The flaw allows remote code execution without ...