CVE lookup

CVE-2026-39987

Pruva has a verified reproduction for CVE-2026-39987: marimo Pre-Auth RCE via Terminal WebSocket Authentication Bypass (/terminal/ws missing validate_auth). The canonical evidence record is REPRO-2026-00316.

REPRO

REPRO-2026-00316

Package

marimo · github

Severity

CRITICAL

Status

published

Open verified reproduction Plain text for agents NVD source