marimo-team News Articles
Recent news articles refferecing the vendors vulnerabilities.
The Hacker NewsCVE-2026-39987Human Attacker Exploits Marimo RCE, Reaches SSH Bastion in Eight Seconds
Attackers exploit Marimo CVE-2026-39987, with one human operator pivoting to an SSH bastion in eight seconds after initial access.
The Hacker NewsCVE-2026-75149Marimo Notebook Flaw Could Run MCP Commands Before Cells Execute in Edit Mode
Marimo fixes CVE-2026-75149, an 8.7-severity flaw that can launch an MCP command before notebook cells run in edit mode.
Chinese Hacker Commands DeepSeek via Telegram to Launch Autonomous Attacks
Chinese-speaking actor used DeepSeek through Hermes Agent to launch attacks after one Telegram instruction in a 460-plus-target operation.
The Hacker NewsCVE-2026-39987Researchers Build Self-Replicating AI Worm That Operates Entirely on Local, Open-Weight Models
An AI-driven worm using a local open-weight LLM autonomously exploited and replicated across 62% of a 33-host test network in 7 days.
SwapupdateCVE-2026-39987Attackers Use LLM Agent for Post-Exploitation After Marimo CVE-2026-39987 Exploit
Ravie LakshmananMay 29, 2026Vulnerability / Artificial Intelligence
The Hacker NewsCVE-2026-39987Attackers Use LLM Agent for Post-Exploitation After Marimo CVE-2026-39987 Exploit
LLM-driven attackers exploited CVE-2026-39987 on May 10, 2026, to steal credentials and exfiltrate a PostgreSQL database.
It Security NewsCVE-2026-39987Hackers Pivot from marimo RCE to Internal Database Using LLM Agent - IT Security News
A newly observed intrusion demonstrates how attackers are replacing static playbooks with AI-driven agents that adapt in real time. The attack began on May 10, 2026, როდესაც threat actors exploited CVE-2026-39987, a remote code execution flaw in the marimo notebook…Read more →
It Security NewsCVE-2026-39987Attackers Weaponize CVE-2026-39987 to Spread Blockchain-Based Backdoor Via Hugging Face - IT Security News
A critical vulnerability in the marimo Python notebook platform is now being actively used by attackers to deploy a blockchain-powered backdoor on developer systems. The flaw, tracked as CVE-2026-39987, allows remote code execution without authentication, making it a dangerous entry…Read more →
It Security NewsCVE-2026-39987Weaponized CVE-2026-39987 Pushes Blockchain Backdoor Through Hugging Face - IT Security News
Attackers are rapidly exploiting CVE-2026-39987 in the marimo Python notebook platform to deploy a new NKAbuse backdoor variant hosted on Hugging Face Spaces, turning AI/ML developer environments into high‑value infection points. The campaign combines pre-auth RCE, credential theft, lateral movement...
Hackers exploit Marimo flaw to deploy NKAbuse malware from Hugging Face
Hackers are exploiting a critical vulnerability in Marimo reactive Python notebook to deploy a new variant of NKAbuse malware hosted on Hugging Face Spaces.
IT Security NewsCVE-2026-39987Marimo RCE Vulnerability Exploited Within 10 Hours of Public Disclosure - IT Security News
A critical remote code execution (RCE) vulnerability in the open-source Python notebook platform Marimo was actively exploited less than 10 hours after its public disclosure. The flaw, initially tracked as GHSA-2679-6mx9-h9xc and later assigned CVE-2026-39987, carries a critical CVSS score…Read more...
Critical Marimo pre-auth RCE flaw now under active exploitation
A critical pre-authentication remote code execution (RCE) vulnerability in Marimo is now under active exploitation, leveraged for credential theft.
The Hacker NewsCVE-2026-39987Marimo RCE Flaw CVE-2026-39987 Exploited Within 10 Hours of Disclosure
Marimo CVE-2026-39987 exploited within 10 hours of disclosure, enabling unauthenticated RCE and credential theft, emphasizing urgent patching needs.
Critical Marimo Flaw Exploited Hours After Public Disclosure
A threat actor started exploiting CVE-2026-39987, an unauthenticated RCE vulnerability in Marimo, nine hours after public disclosure.