Marimo Patches Notebook Flaw That Let Hidden Commands Run on Open
A high-severity bug in the Marimo notebook app could quietly run attacker-supplied commands when a user opened a booby-trapped file in edit mode.
Key points
- Marimo, a Python notebook application, patched a high-severity flaw that let a rigged notebook run a hidden command on the user's computer the moment the file was opened in edit mode.
- The bug abuses the Model Context Protocol (MCP), a standard way for AI tools to talk to outside programs, to launch a local subprocess without the user running any code cell.
- VulnCheck, acting as the official CVE Numbering Authority for the bug, published the advisory describing the issue.
- Users should update to the patched release of Marimo and avoid opening notebooks from untrusted sources until they have done so.
Marimo has fixed a security hole in its notebook software that could hand an attacker code execution on a user's machine as soon as the user opened a malicious file.
The flaw, first reported by The Hacker News, sits in how Marimo handles the Model Context Protocol, or MCP. MCP is a young standard that lets AI assistants and developer tools call outside programs in a structured way. In Marimo's case, an attacker could embed an MCP command inside a notebook file. Open that file in edit mode, and the command runs as a local subprocess on your computer. No cell needs to be executed. No warning appears.
That matters because notebooks get shared like documents. Researchers pass them around. Students download them. Data teams pull them from public repositories. A file that looks like a harmless analysis could quietly launch a program the moment it loads.
What is Marimo, and who uses it?
Marimo is an open-source Python notebook, a document format popular with data scientists and researchers for mixing code, charts and notes in one page. It competes with the widely used Jupyter notebook. Its user base is mostly technical: analysts, machine learning engineers, academics.
The practical worry is the same as with any document-borne attack. If you can be tricked into opening the file, the attacker wins.
How serious is the bug?
VulnCheck, which acts as a CVE Numbering Authority (an organisation authorised to assign official CVE tracking IDs to vulnerabilities), rated the flaw high severity. The published record states the command runs as a local subprocess when the notebook is opened in edit mode. Edit mode is Marimo's default working view, not a niche setting.
A subprocess is simply a separate program launched by the notebook app. It runs with the same permissions as the user who opened the file. If that user is a developer with access to source code, cloud keys or internal systems, the attacker inherits that reach.
| Detail | Value |
|---|---|
| Affected product | Marimo notebook |
| Vulnerability type | Command execution via MCP |
| Trigger | Opening a crafted notebook in edit mode |
| Severity | High |
| CNA of record | VulnCheck |
What should users do now?
Update Marimo to the patched version, then treat any notebook from an unknown sender the way you would treat an unexpected email attachment. If you cannot verify who made the file, do not open it in edit mode.
Teams that share notebooks internally should check where their files come from. Public repositories, forum downloads and unsolicited shares are the highest-risk sources. Running Marimo inside a sandboxed environment, such as a container or a throwaway virtual machine, limits the damage if a bad file slips through.
The broader lesson sits with MCP itself. As more tools wire AI assistants into local systems through this protocol, the surface for these silent-execution bugs grows. Expect more advisories like this one over the coming year, and expect regulators to start asking vendors how they gate MCP calls by default.
