One WebSocket, one Shell: CVE-2026-39987 Explained
How a missing auth check on Marimo's terminal endpoint gives you an interactive shell, and what it took to build a decent client for it
Written by
Software Engineering
I am a developer in Seattle with interests in Security (cyber and IRL), machine learning, and distributed systems.
Responses
Markdown supported · ⌘↵ to post
No responses yet.