Marimo Notebook Flaw Could Run MCP Commands Before Cells Execute in Edit Mode

CVE-2026-75149 is a high-severity code injection vulnerability in Marimo notebook software affecting versions prior to 0.23.15. When a specially crafted notebook is opened in edit mode, an attacker-supplied Model Context Protocol (MCP) server command embedded in the notebook configuration is launched as a local subprocess before any notebook cell is executed. The attack requires user interaction (opening the notebook) but no attacker authentication. The flaw originates from notebook metadata (PEP 723) not being treated as attacker-controlled, allowing malicious configuration sections including 'ai', 'mcp', 'completion', 'secrets', and 'server' to be processed unsafely. The patch introduces an allowlist approach that strips these configuration sections when sourced from notebook metadata. A related vulnerability, CVE-2026-67618 (CVSS 7.1), also in versions before 0.23.15, allows an attacker-controlled AI base_url in notebook metadata to exfiltrate an operator's API key to an attacker-controlled endpoint when the operator makes an AI request. A prior vulnerability, CVE-2026-39987, affected Marimo versions 0.20.4 and earlier via missing authentication on the /terminal/ws WebSocket endpoint, allowing unauthenticated access to a full PTY shell and arbitrary command execution.