keraattin/CVE-2026-39987

GitHubRepository PoCScanner

PoC files

3 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The artifact is a detection scanner for CVE-2026-39987, a pre-authentication remote code execution vulnerability in Marimo. It identifies Marimo instances, extracts versions, and performs a safe WebSocket handshake to check if the /terminal/ws endpoint is accessible without authentication. It does not contain code to exploit the vulnerability or execute commands on a target.

Backdoor review

No backdoor observed in reviewed code

The supplied evidence consists of a Python detection script and a README documentation file for CVE-2026-39987. The Python script performs safe, passive checks (HTTP requests, WebSocket handshake tests) to identify vulnerable Marimo instances. It does not execute commands on target systems, establish persistence, exfiltrate data, or contain any concealed harmful behavior. The README provides documentation and usage examples. No backdoor, trojan, or deceptive payload was observed.

ClassificationScanner
Model confidence98%
AuthenticationNot required
LanguagesPython
Target softwareMarimo
Attack typesMissing Authentication for Critical Function
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The Python script's stated purpose is detection, not exploitation. It explicitly notes 'No commands are executed on target systems' and only performs a WebSocket handshake to check endpoint accessibility. It does not contain any code to send terminal commands, obtain a shell, or exfiltrate data.

CVE-2026-39987_Marimo_RCE_detector.py:3-7CVE-2026-39987_Marimo_RCE_detector.py:86-88CVE-2026-39987_Marimo_RCE_detector.py:381-382

Requirements

  • Python 'requests' library must be installed.CVE-2026-39987_Marimo_RCE_detector.py:35-39
  • Target URL must be provided via command line or file.CVE-2026-39987_Marimo_RCE_detector.py:353-363

Observed behavior

  • Sends HTTP GET requests to /api/status, /api/health, and / to detect Marimo indicators and extract version information.CVE-2026-39987_Marimo_RCE_detector.py:191-253
  • Performs a WebSocket upgrade handshake to /terminal/ws and /ws to check if the terminal endpoint is accessible without authentication.CVE-2026-39987_Marimo_RCE_detector.py:83-150CVE-2026-39987_Marimo_RCE_detector.py:258-273
  • Compares the detected version against known vulnerable ranges and reports a risk level (CRITICAL, HIGH, MEDIUM, LOW, INFO).CVE-2026-39987_Marimo_RCE_detector.py:58-80CVE-2026-39987_Marimo_RCE_detector.py:275-297
  • Outputs scan results to the console and optionally saves them to a JSON file.CVE-2026-39987_Marimo_RCE_detector.py:302-339CVE-2026-39987_Marimo_RCE_detector.py:406-409
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Network Connection
WebSocket handshake to /terminal/ws and /wsThe script sends a WebSocket upgrade request to check endpoint accessibility without sending data through the connection, as described in the code comments and documentation.CVE-2026-39987_Marimo_RCE_detector.py:83-150README.md:289-295
Http Request
GET requests to /api/status, /api/health, /The script probes standard endpoints to identify Marimo instances and extract version information.CVE-2026-39987_Marimo_RCE_detector.py:191-253
Review boundaries

What the analysis did not establish

  • One file (likely requirements.txt) is omitted from the evidence, but its absence does not affect classification of the provided scanner code.
  • The evidence includes a README.md that describes the vulnerability and attack timeline but does not contain executable exploit code.
  • One file (CVE-2026-39987_Marimo_RCE.nse) is omitted from the text evidence; only its metadata is present. This file is referenced in the README as an Nmap NSE script for detection. Its content was not reviewed, but the omission is noted as a material evidence limitation.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1