security_identifier

CVE-2026-39987

Vulnerability identifier for a security flaw in the marimo notebook project.

Current clusters

A hand-debugged Python toolkit turned marimo CVE-2026-39987 into bastion SSH in eight seconds

Sysdig's threat research team watched one operator work a marimo notebook host for nine hours with hand-written scripts, and the eight-second jump to a bastion host at the end ran on tooling already staged on disk.

Publishers:webflow.sysdig.com

Reality

Evidence72
Adoption58
Hype gap+18
Incentives74
Confidence63

build1 publisher

Opening the cohttp fix PR drew traversal probes within ten minutes

Anil Madhavapeddy patched a path traversal bug in OCaml's cohttp and found probes for it in his logs ten minutes after opening the fix PR. His own agent had already built the exploit from a bug-class hint.

Publishers:anil.recoil.org

Reality

Evidence52
Adoption44
Hype gap+14
Incentives55
Confidence57