Nxploited/CVE-2026-39987

GitHubRepository PoCScanner

PoC files

3 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

A mass scanner for CVE-2026-39987 that connects to the unauthenticated Marimo /terminal/ws WebSocket endpoint, executes system commands to enumerate the environment, and collects sensitive data. It does not deliver a payload for remote control or establish a persistent shell for the operator; it verifies access and exfiltrates information.

Backdoor review

No backdoor observed in reviewed code

The supplied PoC is a mass scanner for CVE-2026-39987, a pre-auth RCE in Marimo. It connects to the vulnerable /terminal/ws endpoint, executes commands to enumerate the target system, and drops a proof-of-concept file. All actions are directed at the target host specified by the operator. No evidence of concealed harm, data exfiltration to an undisclosed third party, or misrepresented local execution was found.

ClassificationScanner
Model confidence98%
AuthenticationNot required
LanguagesPython
Target softwaremarimo
Attack typesMissing AuthenticationInformation Disclosure
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact's primary operation is to detect and validate the vulnerability by connecting to the target, executing reconnaissance commands, and collecting data. It is explicitly labeled as a 'MASS SCANNER' in its own banner and documentation. It does not provide the operator with an interactive shell or establish a backdoor; it only verifies access and exfiltrates information, which is characteristic of a scanner.

CVE-2026-39987.py:4README.md:15-16

Requirements

  • Target must be running a vulnerable version of Marimo (< 0.23.0) with the /terminal/ws endpoint exposed.README.md:42-46
  • Scanner requires Python 3.10+ and the websockets, rich, requests, and urllib3 libraries.README.md:100-108

Observed behavior

  • Connects to the /terminal/ws WebSocket endpoint without valid authentication, using a dummy Authorization header.CVE-2026-39987.py:1107-1113
  • Executes system commands (e.g., id, whoami, uname -a, ps aux, env) via the WebSocket shell to collect identity, system, and environment information.CVE-2026-39987.py:1117-1118CVE-2026-39987.py:376-381
  • Enumerates sensitive files and configurations, including /etc/shadow, SSH keys, database credentials, .env files, and Marimo notebooks and tokens.CVE-2026-39987.py:654-667CVE-2026-39987.py:690-707CVE-2026-39987.py:430-521
  • Writes a proof-of-concept file (Nx) to the web root and attempts to verify it via HTTP to confirm web accessibility.CVE-2026-39987.py:964-1023
  • Saves all collected data into a structured per-target output directory and generates summary files.CVE-2026-39987.py:1141-1175
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Target Command Execution
id, whoami, uname -a, cat /etc/shadow, etc.The script sends these commands over the WebSocket to the target host to enumerate the system. This is the disclosed exploit behavior.CVE-2026-39987.py:372-378CVE-2026-39987.py:655-657
Target File Write
printf '%s' '{content}' > {nx_path}The script writes a proof-of-concept file (e.g., Nx.py) to the target's web root to verify write access and HTTP reachability. This is a standard PoC verification step.CVE-2026-39987.py:977
Local File Write
nx_output/ directoryThe script saves collected target data locally to the nx_output/ directory. This is expected behavior for a scanner and does not involve exfiltration to an external party.CVE-2026-39987.py:55-58
Fixed Authorization Header
Authorization: Bearer random-token-1234567890The script uses a fixed, non-secret Authorization header to connect to the WebSocket. The README explicitly states the header value is irrelevant, which aligns with the CVE description of missing authentication. This is not a concealed credential.CVE-2026-39987.py:1107README.md:314
Review boundaries

What the analysis did not establish

  • One file (requirements.txt) was omitted from the evidence due to being unclassified, but its absence does not affect the classification of the primary Python script and README.
  • One file (requirements.txt) was omitted from the text evidence but is listed as a non-executable dependency list in the README and is not required for behavioral analysis.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1