CVE-2026-39987: marimo Pre-Auth RCE via Terminal WebSocket Authentication Bypass (/terminal/ws missing validate_auth) (REPRO-2026-00316)

Pruva

Verified reproduction

CVE-2026-39987: marimo Pre-Auth RCE via Terminal WebSocket Authentication Bypass (/terminal/ws missing validate_auth)

CVE-2026-39987 is verified against marimo · github affected versions: <0.23.0 fixed version: 0.23.0 vulnerability class: RCE This critical reproduction includes runnable sandbox proof, artifacts, and a plain-text agent view under REPRO-2026-00316.

REPRO-2026-00316 marimo · github RCE Jul 30, 2026 CVE entry .txt

Severity CRITICAL

Confidence HIGH

Reproduced in 24m 19s

Tool calls 134

Spend $2.29

Affected <0.23.0

Fixed in 0.23.0

01 · Reproduce

Download script Open in Codespaces →

$ pruva-verify REPRO-2026-00316

or

curl -O https://pruva.dev/api/v1/reproductions/REPRO-2026-00316/artifacts/bundle/repro/reproduction_steps.sh && chmod +x reproduction_steps.sh && ./reproduction_steps.sh

Run in a VM or disposable container. This exploits a real vulnerability.

02 · The vulnerability

Pre-authentication remote code execution in marimo (Python notebook, ~19.6k GitHub stars). The terminal WebSocket endpoint /terminal/ws completely skips authentication validation, allowing an unauthenticated attacker to obtain a full interactive PTY shell and execute arbitrary OS commands with the privileges of the marimo process (often root in Docker).

03 · Root cause

04 · Reproduction transcript

The agent's step-by-step process — every tool call, every handoff, the moment the exploit fired.

Loading session...

05 · Artifacts

Scripts, logs, diffs, and output captured during the reproduction.

bundle/repro/reproduction_steps.sh10.4 KB

bundle/repro/ws_exploit_client.py1.9 KB

bundle/repro/rca_report.md7.4 KB

bundle/repro/runtime_manifest.json0.7 KB

bundle/logs/reproduction_steps.log4.5 KB

bundle/logs/vuln_unauth_attempt1.log0.3 KB