CVE-2026-39987 Details.
Marimo <= 0.20.4 - Pre-Auth Terminal WebSocket RCE
Atlas does not check this one. Not a plain web check.
This weakness is not found through ordinary web pages. It needs a different kind of connection to the service. Atlas only runs plain web, DNS and TLS checks, so it does not run this one.
About CVE-2026-39987. What It Means.
Marimo versions <= 0.20.4 contain an unauthenticated remote code execution vulnerability. The terminal WebSocket endpoint /terminal/ws lacks authentication validation, allowing an unauthenticated attacker to connect via WebSocket, obtain a full PTY shell, and execute arbitrary OS commands on the underlying server.
Affected Product. What Is Hit.
- Vendor
- marimo-team
- Product
- Marimo Team Marimo
FAQ
Common Questions.
Marimo <= 0.20.4 - Pre-Auth Terminal WebSocket RCE. Marimo versions <= 0.20.4 contain an unauthenticated remote code execution vulnerability. The terminal WebSocket endpoint /terminal/ws lacks authentication validation, allowing an unauthenticated attacker to connect via WebSocket, obtain a full PTY shell, and execute arbitrary OS commands on the underlying server.
No. This weakness is not found through ordinary web pages. It needs a different kind of connection to the service. Atlas only runs plain web, DNS and TLS checks, so it does not run this one. The facts about CVE-2026-39987 are on this page, and you can request a demo to see how Brandefense watches your whole external attack surface.
Yes. CVE-2026-39987 is on the CISA Known Exploited Vulnerabilities list, which means attackers have used it against real targets.
Update Marimo Team Marimo to the latest version from the vendor, or follow the vendor's advice to switch off the affected feature. Vendor links are listed on this page when they are known.
This page lists the public facts about CVE-2026-39987. Atlas does not run a check for it, so nothing here says whether a particular site is affected.