A serious security issue in the Marimo Python notebook platform was quickly taken advantage of by hackers, starting only 10 hours after the vulnerability was made public.

The security weakness, identified as CVE-2026-39987 and rated critical (9.3/10) by GitHub, enables unauthorized remote code execution in Marimo versions up to 0.20.4.

Sysdig researchers reported that malicious actors crafted an exploit using information from the developer’s announcement and immediately launched attacks focused on stealing sensitive data.

Marimo, available as open-source, is a Python notebook environment popular among data scientists, machine learning engineers, researchers, and developers for creating interactive applications and dashboards. The project has garnered significant attention, boasting 20,000 stars and 1,000 forks on GitHub.

CVE-2026-39987 arises from the WebSocket endpoint ‘/terminal/ws’ which provides an interactive terminal lacking proper authentication, allowing anyone to connect without authorization.

This flaw grants direct access to a fully interactive shell with the same level of permissions as the Marimo process.

Marimo announced the vulnerability on April 8 and released version 0.23.0 the following day as a fix. They cautioned that the vulnerability impacts users running Marimo in editable mode and those exposing it to shared networks using –host 0.0.0.0 while in that mode.

Sysdig noted that within half a day of the vulnerability being disclosed, 125 distinct IP addresses began scanning for vulnerable systems.

Exploitation attempts, specifically aimed at stealing credentials, were observed less than 10 hours after the public disclosure.

The attacker initially verified the vulnerability by connecting to the /terminal/ws endpoint and running a brief script to confirm remote code execution before disconnecting.

Shortly thereafter, the attacker re-established the connection and engaged in manual probing, issuing commands like pwd, whoami, and ls to understand the system’s environment, followed by attempts to navigate directories and check for SSH-related files.

The attacker then prioritized credential harvesting, targeting the .env file to extract environment variables, including cloud credentials and application secrets. They proceeded to read additional files in the working directory and search for SSH keys.

According to a Sysdig report, this entire credential theft process took less than three minutes.

Around an hour later, the attacker returned for a second exploitation attempt, employing the same exploit sequence.

Researchers believe that the attack was carried out by a “methodical operator” using a hands-on approach, rather than automated tools, focused on acquiring high-value targets like .env credentials and SSH keys.

The attackers did not attempt to install persistent access, deploy cryptocurrency miners, or backdoors, indicating a quick and discreet operation.

Marimo users are strongly advised to upgrade to version 0.23.0 immediately, monitor WebSocket connections to ‘/terminal/ws,’ restrict external access using a firewall, and change any compromised secrets.

If upgrading is not immediately feasible, blocking or disabling access to the ‘/terminal/ws’ endpoint offers an effective temporary solution.