Critical Remote Code Execution Vulnerability in Marimo Notebook

What changed

The Marimo notebook, a reactive Python tool, has been found to contain a pre-authentication remote code execution (RCE) vulnerability. This flaw, present in versions prior to 0.23.0, allows attackers to gain unauthorized access to a full pseudo-terminal shell via the /terminal/ws WebSocket endpoint.

The vulnerability arises because the endpoint fails to implement necessary authentication checks, unlike other WebSocket endpoints that correctly validate user authentication.

Who is affected

Users of the Marimo notebook prior to version 0.23.0 are at risk due to this vulnerability. The following groups are particularly affected:

Organizations utilizing Marimo for development or data analysis tasks may find their systems exposed to unauthorized command execution.

• CoreWeave, the vendor of Marimo, is directly responsible for addressing this vulnerability.
• Developers and data scientists using Marimo notebooks in their workflows.
• Enterprises that rely on Marimo for interactive programming and data processing.

What to do

To mitigate the risks associated with this vulnerability, users should take immediate action by upgrading to the latest version of Marimo.

Regularly monitoring for updates and security patches is essential to maintain system integrity and protect against potential exploits.

• Upgrade Marimo to version 0.23.0 or later to ensure protection against this vulnerability.
• Review and enhance security protocols for WebSocket connections in your applications.
• Educate team members about the importance of timely software updates and security practices.