---
title: "Discussion on \"One WebSocket, one Shell: CVE-2026-39987 Explained\" | Hashnode"
description: "Discussion on \"One WebSocket, one Shell: CVE-2026-39987 Explained\". How a missing auth check on Marimo's terminal endpoint gives you an interactive shell, and what it took to build a decent client for it"
url: "https://hashnode.com/posts/one-websocket-one-shell-cve-2026-39987-explained/6a7eb29add64b3da154c03a4"
---

[Feed](https://hashnode.com/feed) /

Discussion

# [One WebSocket, one Shell: CVE-2026-39987 Explained](https://wind010.hashnode.dev/one-websocket-one-shell-cve-2026-39987-explained?utm_source=hashnode&utm_medium=feed)

How a missing auth check on Marimo's terminal endpoint gives you an interactive shell, and what it took to build a decent client for it

Aug 14 · 10 min read · wind010.hashnode.dev  
Read the article

-   [#marimo](https://hashnode.com/tag/marimo)
-   [#websocket](https://hashnode.com/tag/websocket)
-   [#rce](https://hashnode.com/tag/rce)
-   [#cve-2026-39987](https://hashnode.com/tag/cve-2026-39987)
-   [#cybersecurity](https://hashnode.com/tag/cybersecurity)
-   [#hacking](https://hashnode.com/tag/hacking)

## Written by

[Jeff Tong](https://hashnode.com/@Wind010)

@Wind010 · Seattle, WA

  
[View profile](https://hashnode.com/@Wind010)

Software Engineering

I am a developer in Seattle with interests in Security (cyber and IRL), machine learning, and distributed systems.

## Responses

Markdown supported · ⌘↵ to post

No responses yet.