Horizon Alert
Summary of the vulnerability and why it matters
Marimo, a reactive Python notebook, has a critical vulnerability that allows unauthenticated attackers to gain shell access and run arbitrary commands. This issue arises because a specific web endpoint does not properly validate user authentication before allowing connections.
- Allows remote code execution.
- Affects unauthenticated users.
- Impacts Marimo notebook environments.
Attack Path
How an attacker could exploit the issue
An attacker can exploit this vulnerability by sending unauthenticated requests to the `/terminal/ws` endpoint of a vulnerable Marimo instance. This allows them to establish a WebSocket connection and gain a full PTY shell, enabling the execution of arbitrary system commands on the server.
- No authentication required.
- Targets WebSocket endpoint.
- Unauthenticated remote code execution.
Live Threat
Current exploitation, exposure, and threat context
This vulnerability presents a significant risk due to its pre-authentication nature and the ability to achieve remote code execution, granting an attacker a full PTY shell. Although the affected product, Marimo, is typically used in development or internal environments, the direct exploitation path makes it attractive. Attackers are drawn to vulnerabilities that bypass authentication and offer immediate system control.
- KEV listed: Yes
- Exploitation observed: Publicly documented
- Recency signal: Within last 6 months
Priority actions
Operational Fix
Recommended remediation, mitigation, and detection steps
Prioritize immediate patching of Marimo to version 0.23.0 or later to fix the critical pre-authentication RCE vulnerability. If patching is delayed, isolate affected services to prevent exploitation, and rigorously monitor network traffic for suspicious WebSocket connections to the `/terminal/ws` endpoint. Confirm successful deployment of the patch or the effectiveness of isolation measures.
- Patch Marimo to version 0.23.0+.
- Isolate affected Marimo instances.
- Monitor for `/terminal/ws` connections.
