Search: CVE-2026-39987

1 threat

Severity	CVSS	Signals	Threat	Source	Published	Score and star
Critical	9.3	KEVEPSS 99%	CVE-2026-39987marimo · Missing Authentication Critical9.3KEVEPSS 99%2026-04-09CVE Database V5CVE-2026-39987 Marimo versions prior to 0.23.0 contain a critical vulnerability where the /terminal/ws WebSocket endpoint lacks authentication. This allows unauthenticated attackers to gain a full PTY shell and execute arbitrary system commands remotely. The issue arises because this endpoint does not perform authentication validation unlike other endpoints. The vulnerability is fixed in version 0.23.0. KEVEPSS 99%Vulnerability marimo-team CWE-306	CVE Database V5	2026-04-09

Page 1 of 1 · 2 duplicate CVE records merged