marimo MCP Server Configuration Code Injection (CVE-2026-75149)

Technical Analysis

marimo parses notebook configuration data and, upon detecting an MCP server entry, spawns the specified command as a local subprocess to presumably initialize or connect to that MCP server. Because this launch occurs during notebook loading in edit mode rather than during explicit cell execution, an attacker can embed a crafted MCP server command field in a shared or downloaded notebook file to achieve code execution the moment the victim opens it. This crosses a trust boundary: notebook content, which should be treated as untrusted data, is instead interpreted as an executable tool/server declaration, effectively turning notebook-sharing (a common collaborative workflow) into a supply-chain-style delivery mechanism for arbitrary local command execution. The attacker gains full local code execution privileges of the marimo user process, which can lead to credential theft, lateral movement, or further compromise of any connected agent tooling.

Affected Systems

marimo; protocols: MCP

Detection Signatures

• Notebook files containing unexpected or non-standard 'mcp' / 'mcp_server' configuration blocks
• MCP server 'command' fields referencing shell metacharacters, absolute paths to unexpected binaries, curl/wget/base64/eval-like invocations
• Unexpected subprocess spawn events correlated with marimo notebook open/edit-mode launch (parent process marimo, child process shell interpreter or network tool)
• Notebooks sourced from external/untrusted repositories, email attachments, or shared links that include MCP config sections
• Process creation logs showing subprocess execution occurring before any cell execution telemetry in marimo session logs

Remediation Steps

1. 1

   Upgrade marimo

   Update to marimo 0.23.15 or later, which patches the MCP server configuration handler to prevent unauthorized command execution.

2. 2

   Treat notebooks as untrusted input

   Do not open notebooks from unknown or untrusted sources in edit mode until verified; strip or inspect MCP server configuration blocks before opening.

3. 3

   Sandbox notebook execution

   Run marimo in a restricted environment (container, VM, limited-privilege user) so that any subprocess launched via notebook configuration cannot access sensitive resources.

4. 4

   Add configuration validation

   Require explicit user confirmation before marimo launches any subprocess derived from embedded MCP server declarations, rather than auto-launching on load.

5. 5

   Monitor for anomalous subprocess spawns

   Deploy EDR/host monitoring to flag subprocess creation by marimo processes immediately after notebook file opens, especially before any cell execution.