marimo-team News Articles
Recent news articles refferecing the vendors vulnerabilities.
It Security NewsCVE-2026-39987Attackers Weaponize CVE-2026-39987 to Spread Blockchain-Based Backdoor Via Hugging Face - IT Security News
A critical vulnerability in the marimo Python notebook platform is now being actively used by attackers to deploy a blockchain-powered backdoor on developer systems. The flaw, tracked as CVE-2026-39987, allows remote code execution without authentication, making it a dangerous entry…Read more →
2 weeks ago
It Security NewsCVE-2026-39987Weaponized CVE-2026-39987 Pushes Blockchain Backdoor Through Hugging Face - IT Security News
Attackers are rapidly exploiting CVE-2026-39987 in the marimo Python notebook platform to deploy a new NKAbuse backdoor variant hosted on Hugging Face Spaces, turning AI/ML developer environments into high‑value infection points. The campaign combines pre-auth RCE, credential theft, lateral movement...
2 weeks ago
Hackers exploit Marimo flaw to deploy NKAbuse malware from Hugging Face
Hackers are exploiting a critical vulnerability in Marimo reactive Python notebook to deploy a new variant of NKAbuse malware hosted on Hugging Face Spaces.
2 weeks ago
IT Security NewsCVE-2026-39987Marimo RCE Vulnerability Exploited Within 10 Hours of Public Disclosure - IT Security News
A critical remote code execution (RCE) vulnerability in the open-source Python notebook platform Marimo was actively exploited less than 10 hours after its public disclosure. The flaw, initially tracked as GHSA-2679-6mx9-h9xc and later assigned CVE-2026-39987, carries a critical CVSS score…Read more...
2 weeks ago
Critical Marimo pre-auth RCE flaw now under active exploitation
A critical pre-authentication remote code execution (RCE) vulnerability in Marimo is now under active exploitation, leveraged for credential theft.
3 weeks ago
The Hacker NewsCVE-2026-39987Marimo RCE Flaw CVE-2026-39987 Exploited Within 10 Hours of Disclosure
Marimo CVE-2026-39987 exploited within 10 hours of disclosure, enabling unauthenticated RCE and credential theft, emphasizing urgent patching needs.
3 weeks ago
Critical Marimo Flaw Exploited Hours After Public Disclosure
A threat actor started exploiting CVE-2026-39987, an unauthenticated RCE vulnerability in Marimo, nine hours after public disclosure.
3 weeks ago