Tuesday, August 25, 2026 · 3 of 5
Marimo patched CVE-2026-75149 (CVSS 8.7): opening a crafted notebook in edit mode runs an attacker-supplied MCP command as a local subprocess, before any cell executes
— fixed in 0.23.15 (Aug 19; broad coverage Aug 25)