https://vulnerability.circl.lu/sightings/feed 2026-08-28T23:31:09.337582+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/630971f2-23b4-4494-ae3d-7628bec709ba/export 2026-08-28T23:31:09.360233+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "630971f2-23b4-4494-ae3d-7628bec709ba", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-75149", "type": "seen", "source": "https://t.me/pphm_HackerNews/2854", "content": "\ud83d\udd34 Marimo Notebook Flaw Could Run MCP Commands Before Cells Execute in Edit Mode\n\nMarimo has addressed a high-severity security flaw in its notebook software that allowed an attacker to execute an attacker-supplied Model Context Protocol (MCP) command in a specially crafted notebook, according to VulnCheck's CVE Numbering Authority (CNA) record.\n\nThe CNA record says the command can run as a local subprocess when the notebook is opened in edit mode.\n\nThe vulnerability, tracked as CVE-2026-75149, is a code injection issue affecting versions prior to 0.23.15. VulnCheck's CVE Numbering Authority (CNA) record assigns it a CVSS v4 score of 8.7 and a CVSS v3.1 score of 8.8, with user interaction required and no attacker authentication required.", "creation_timestamp": "2026-08-27T00:00:10.990235Z"} 2026-08-27T00:00:10.990235+00:00 https://vulnerability.circl.lu/sighting/319796b1-d9b1-41e9-8a3c-b52ef8afa99b/export 2026-08-28T23:31:09.362148+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "319796b1-d9b1-41e9-8a3c-b52ef8afa99b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-75149", "type": "published-proof-of-concept", "source": "https://t.me/thehackernews/9888", "content": "\u203c\ufe0f A Marimo notebook can launch MCP commands before cells run.\n\nCVE-2026-75149 triggers when a crafted notebook is opened in edit mode. It affects versions before 0.23.15.\nMarimo fixed it in 0.23.15.\n\nRead the details: https://thehackernews.com/2026/08/marimo-notebook-flaw-could-run-mcp.html", "creation_timestamp": "2026-08-27T00:00:09.383140Z"} 2026-08-27T00:00:09.383140+00:00 https://vulnerability.circl.lu/sighting/57187083-9583-4f6d-937c-3fc4d76933c5/export 2026-08-28T23:31:09.362308+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "57187083-9583-4f6d-937c-3fc4d76933c5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-75149", "type": "published-proof-of-concept", "source": "https://t.me/thehackernews/9888", "content": "\u203c\ufe0f A Marimo notebook can launch MCP commands before cells run.\n\nCVE-2026-75149 triggers when a crafted notebook is opened in edit mode. It affects versions before 0.23.15.\nMarimo fixed it in 0.23.15.\n\nRead the details: https://thehackernews.com/2026/08/marimo-notebook-flaw-could-run-mcp.html", "creation_timestamp": "2026-08-26T19:00:03.568778Z"} 2026-08-26T19:00:03.568778+00:00 https://vulnerability.circl.lu/sighting/abb5fd5c-3ca0-41e1-ad37-9dd89c0d4320/export 2026-08-28T23:31:09.362423+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "abb5fd5c-3ca0-41e1-ad37-9dd89c0d4320", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-75149", "type": "seen", "source": "https://t.me/pphm_HackerNews/2854", "content": "\ud83d\udd34 Marimo Notebook Flaw Could Run MCP Commands Before Cells Execute in Edit Mode\n\nMarimo has addressed a high-severity security flaw in its notebook software that allowed an attacker to execute an attacker-supplied Model Context Protocol (MCP) command in a specially crafted notebook, according to VulnCheck's CVE Numbering Authority (CNA) record.\n\nThe CNA record says the command can run as a local subprocess when the notebook is opened in edit mode.\n\nThe vulnerability, tracked as CVE-2026-75149, is a code injection issue affecting versions prior to 0.23.15. VulnCheck's CVE Numbering Authority (CNA) record assigns it a CVSS v4 score of 8.7 and a CVSS v3.1 score of 8.8, with user interaction required and no attacker authentication required.", "creation_timestamp": "2026-08-26T03:00:03.573950Z"} 2026-08-26T03:00:03.573950+00:00 https://vulnerability.circl.lu/sighting/3fbbada6-9926-4285-bb8c-7e59c63197c2/export 2026-08-28T23:31:09.362529+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "3fbbada6-9926-4285-bb8c-7e59c63197c2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-75149", "type": "seen", "source": "https://bsky.app/profile/infosecbriefly.bsky.social/post/3mtvx5cqydc2m", "content": "CVE-2026-75149 lets crafted Marimo notebooks execute attacker-supplied MCP commands as local subprocesses when opened in edit mode; fixed in 0.23.15.\n", "creation_timestamp": "2026-08-25T13:42:37.647863Z"} 2026-08-25T13:42:37.647863+00:00 https://vulnerability.circl.lu/sighting/161352d1-bf22-46ed-8275-a7269f9538fa/export 2026-08-28T23:31:09.362629+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "161352d1-bf22-46ed-8275-a7269f9538fa", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-75149", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mtodwdulv325", "content": "CVE-2026-75149\nVersions of marimo before 0.23.15 let an attacker place a specially crafted server setting in a notebook. When that notebook is opened for editing, the program will automatically run the attacker\u2019s command on\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#CVE #infosec", "creation_timestamp": "2026-08-22T13:10:04.457622Z"} 2026-08-22T13:10:04.457622+00:00 https://vulnerability.circl.lu/sighting/68ffc02a-8cc6-4f03-8383-335c25849f4f/export 2026-08-28T23:31:09.362726+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "68ffc02a-8cc6-4f03-8383-335c25849f4f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-75149", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mthg4ubkfb27", "content": "\ud83d\udfe0 CVE-2026-75149 - High (8.8)\n\nmarimo before 0.23.15 contains a code injection vulnerability in the notebook configuration handl...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-75149/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-08-19T19:00:52.861106Z"} 2026-08-19T19:00:52.861106+00:00 https://vulnerability.circl.lu/sighting/11634cbf-ebdb-4100-baaa-accac35f82d4/export 2026-08-28T23:31:09.362816+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "11634cbf-ebdb-4100-baaa-accac35f82d4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-75149", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/fpt3gt6vrui2y", "content": "CVE-2026-75149 - marimo\nCVE ID : CVE-2026-75149\n \n Published : Aug. 19, 2026, 6:17 p.m. | 13\u00a0minutes ago\n \n Description : marimo before 0.23.15 contains a code injection vulnerability in the notebook configuration handler that allows attackers to execute arbitrary commands by ...", "creation_timestamp": "2026-08-19T19:00:43.080490Z"} 2026-08-19T19:00:43.080490+00:00