SecurityThe Hacker Newsabout 2 hours ago
Marimo Notebook Flaw Runs MCP Commands in Edit Mode
1 min read
Marimo fixed CVE-2026-75149, a high-severity code injection flaw allowing attacker-supplied MCP commands to run as local subprocesses before cell execution in edit mode. The issue affects versions before 0.23.15, which patches it. Gregory Tan discovered the flaw.
Level
Hype check
Tap to vote and see what everyone thinks.
