CVE record published for a marimo flaw where a notebook's own MCP server entry ran as a subprocess on open

VulnCheck published CVE-2026-75149 on 2026-08-19, recording a code injection in the marimo notebook environment that ran through its MCP server configuration. The affected range is everything below 0.23.15, which shipped on 2026-07-23, four weeks before the record appeared.

The vector is the notebook file itself. The record states that marimo's notebook configuration handler let an attacker supply a crafted MCP server entry with an attacker-controlled command value embedded in a notebook, and that opening that notebook in edit mode caused marimo to launch the specified command as a local subprocess. It happened before any notebook cell was executed and required no authentication, so the usual assumption that reviewing a notebook without running its cells is safe did not hold. Sharing a notebook file was enough to deliver the payload. VulnCheck scores it 8.7 high on CVSS 4.0 and 8.8 high on CVSS 3.1, with the user-interaction metric accounting for the need to open the file.

The pattern is worth separating from the more familiar one. Most MCP security records describe a server mistreating input it receives from a model or a caller. Here the MCP configuration itself was the payload, and the client-side program that read the configuration was the thing that executed it. Any host that reads server definitions out of a document supplied by someone else inherits the same question.

The fix is easy to miss in the project's own history. Pull request #10281, merged 2026-07-23, is titled "fix: additional pep 723 sanitization" and summarised as hardening of PEP 723 config options; it touches marimo's config manager and reader and does not mention MCP anywhere in its message. PEP 723 inline script metadata is the mechanism by which a notebook carries configuration, which is how an MCP server entry got there in the first place. The pull request is co-authored by Grg0rry, the same Gregory Tan the CVE record credits as reporter. marimo is now at 0.24.0, so the fixed line has already been superseded.