Vulnerabilidades de Coreweave
CVEs publicadas que afetam produtos de Coreweave: 1 registro(s), com severidade, exploração e correções.
CVE-2026-39987
Crítica · 9.8
KEV Urgente · 81 Exploit público CWE-306 09/04/2026
Marimo Remote Code Execution Vulnerability
marimo is a reactive Python notebook. Prior to 0.23.0, Marimo has a Pre-Auth RCE vulnerability. The terminal WebSocket endpoint /terminal/ws lacks authentication validation, allowing an unauthenticated attacker to obtain a full PTY shell and execute arbitrary system commands. Unlike other WebSocket endpoints (e.g., /ws) that correctly call validate_auth() for authentication, the /terminal/ws endpoint only checks the running mode and platform support before accepting connections, completely skipping authentication verification. This vulnerability is fixed in 0.23.0.