Marimo, a reactive Python notebook environment designed for interactive data science and machine learning, patched a high-severity vulnerability that permitted execution of arbitrary Model Context Protocol (MCP) commands before notebook cells execute during editing sessions.
The flaw allows an attacker to inject a malicious MCP command into a specially crafted notebook file. When a user opens that notebook in edit mode, the injected command runs as a local subprocess before any cell code executes. This execution occurs automatically without explicit user action to run cells, creating a silent code execution vector.
MCP, the Model Context Protocol, enables external systems to interact with language models and integrate tools into AI workflows. Marimo's integration with MCP allows notebooks to invoke external commands and services. The vulnerability exploits this integration by executing attacker-controlled subprocess commands at the time of notebook opening rather than requiring deliberate cell execution.
The attack chain follows a social engineering pattern. An attacker crafts a malicious notebook file and distributes it through email, file sharing platforms, or code repositories. When a researcher, analyst, or developer opens the notebook in Marimo's edit mode to review or modify its contents, the embedded MCP command executes immediately. The subprocess runs with the privileges of the user opening the notebook, potentially providing access to local files, environment variables, API credentials, or internal network resources.
This execution timing is particularly dangerous. Users typically open notebooks in edit mode to examine code structure or make modifications before running cells. The expectation that opening a file for review does not execute code is a fundamental assumption in development environments. Marimo violated that assumption by processing MCP commands during the edit phase rather than confining execution to deliberate cell runs.
The vulnerability affects organizations and individuals using Marimo for collaborative data science work. Researchers sharing notebooks within teams face risk if malicious actors introduce compromised files into shared repositories. Data scientists downloading notebooks from untrusted sources without code review become vulnerable. Machine learning teams using notebooks for reproducible experiments may unknowingly execute attacker code if the notebook supply chain is compromised.
Marimo released a patched version addressing the flaw. The fix likely defers MCP command execution until explicit cell execution requests rather than processing commands during notebook initialization or edit mode entry. Users should update to the latest Marimo version immediately.
The organization confirmed the vulnerability details through VulnCheck's CNA record, which maintains the authoritative CVE database. However, specific CVE identifier assignment and detailed technical documentation remain pending publication on the official National Vulnerability Database.
This incident underscores broader security concerns in notebook environments. Jupyter, RStudio, and similar interactive computing platforms have historically struggled with code execution timing and trust boundaries. Notebooks often treat cells as safe for review but executable when run, yet integration with external protocols, APIs, and Model Context Protocol tools blurs those boundaries. Development teams relying on notebook environments should review their trust models and implement strict code review processes for shared notebook files, particularly those from external sources.
Organizations using Marimo should prioritize patching, validate that no malicious notebooks exist in their repositories, and consider restricting notebook sources to trusted, internally controlled systems.