What happened
Published 2026-08-19 (CVSS 8.8, High), this code-injection vulnerability in marimo's notebook configuration handler triggers arbitrary command execution via an embedded MCP server entry as soon as the notebook is opened in edit mode.
Why it matters
This turns a routine, common developer action — opening a notebook someone shared with you — into unauthenticated RCE, because the MCP configuration surface (meant to let developers wire local AI-agent tools into notebooks) was trusted without validation; it's a textbook example of MCP config becoming a new supply-chain / malicious-document attack surface for AI-tooling users.
Attack vector
A notebook file can embed a crafted MCP server entry with an attacker-controlled command value. When the notebook is opened in edit mode, marimo's configuration handler launches this command as a local subprocess before any notebook cell executes and without requiring authentication or user confirmation.
Affected systems
marimo before 0.23.15
Mitigation
Upgrade to marimo ≥0.23.15. Treat untrusted marimo notebooks as executable content; do not open unreviewed notebooks in edit mode.