{"uuid": "abb5fd5c-3ca0-41e1-ad37-9dd89c0d4320", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-75149", "type": "seen", "source": "https://t.me/pphm_HackerNews/2854", "content": "\ud83d\udd34 Marimo Notebook Flaw Could Run MCP Commands Before Cells Execute in Edit Mode\n\nMarimo has addressed a high-severity security flaw in its notebook software that allowed an attacker to execute an attacker-supplied Model Context Protocol (MCP) command in a specially crafted notebook, according to VulnCheck's CVE Numbering Authority (CNA) record.\n\nThe CNA record says the command can run as a local subprocess when the notebook is opened in edit mode.\n\nThe vulnerability, tracked as CVE-2026-75149, is a code injection issue affecting versions prior to 0.23.15. VulnCheck's CVE Numbering Authority (CNA) record assigns it a CVSS v4 score of 8.7 and a CVSS v3.1 score of 8.8, with user interaction required and no attacker authentication required.", "creation_timestamp": "2026-08-26T03:00:03.573950Z"}