Threat · curated 25 Aug 2026
A Malicious Webpage Could Poison Your Local AI Model Behind NVIDIA NemoClaw
First reported · updated · 2 reports thehackernews.com
Coverage timeline
Why it matters
NVIDIA NemoClaw's default binding of a local model server to all interfaces would let a drive-by webpage poison the model backing an AI agent, a stealthy persistence vector operators currently cannot verify against because no CVE or patched version exists.
Oasis Security disclosed a weakness in NVIDIA NemoClaw where a malicious webpage could take unauthenticated control of the local Ollama instance serving an AI agent and plant hidden instructions inside the model itself. The report notes NemoClaw launches Ollama with OLLAMA_HOST=0.0.0.0:11434, binding the model server to every network interface, but carries no CVE, no affected version range, and no patch, and no exploitation had been reported as of August 25, 2026.
Summary
CVE-2026-75149 is a high-severity code injection vulnerability (CWE-94) in the marimo notebook application's configuration handler, affecting all versions prior to 0.23.15. A specially crafted notebook can embed an attacker-controlled Model Context Protocol (MCP) server command that marimo launches as a local subprocess as soon as the notebook is opened in edit mode—before any notebook cell is executed and without requiring authentication.[0][8]
The issue was assigned by VulnCheck's CNA, published on August 19, 2026, and carries a CVSS v4 score of 8.7 (High) and a CVSS v3.1 score of 8.8. Marimo remediated the flaw in version 0.23.15 via a PEP 723 hardening patch that treats notebook metadata as attacker-controlled and filters notebook-supplied configuration through an allowlist. There is no evidence in the supplied reporting of in-the-wild exploitation.[0][8]
Attack chain
- Delivery: An attacker crafts a malicious marimo notebook that embeds an attacker-controlled MCP server entry with a malicious command value in the notebook configuration/metadata, and delivers it to a victim.[0][8]
- User interaction / trigger: The victim opens the crafted notebook in edit mode; user interaction is required but no authentication or cell execution is needed.[0][8]
- Code execution: Marimo launches the attacker-specified command as a local subprocess before any notebook cell is executed, achieving arbitrary command execution.[0][8]
Disclosure timeline
| Date | Event |
|---|---|
| 2026-07-23 | Marimo version 0.23.15, the release that fixes the vulnerability, is published.[0] |
| 2026-08-04 | Related VulnCheck advisory CVE-2026-67618 (AI base_url API key exfiltration via notebook PEP 723 metadata, CVSS 7.1) is disclosed.[0] |
| 2026-08-17 | Marimo 0.24.0 is released on PyPI (confirmed as the current release on August 25).[0] |
| 2026-08-19 | CVE-2026-75149 is published (OSV published timestamp 2026-08-19).[8][0] |
| 2026-08-23 | OSV record for CVE-2026-75149 last modified.[8] |
How it works
The vulnerability resides in marimo's notebook configuration handler. A notebook can embed configuration—including an MCP server entry with a command value—that marimo trusts and acts upon. When the notebook is opened in edit mode, marimo launches the attacker-supplied command as a local subprocess before any notebook cell runs, so no cell execution or authentication is required to trigger the code injection (CWE-94).[8][0]
The fix (version 0.23.15) is a PEP 723 hardening patch that treats notebook metadata as attacker-controlled and passes notebook-supplied configuration through an allowlist, stripping the ai, mcp, completion, secrets, and server configuration sections. The patch's MCP regression test uses an attacker-controlled URL and verifies the mcp section is removed.[0]
Affected versions and patch status
| Product | Affected | Patch status |
|---|---|---|
| marimo (marimo-team/marimo notebook) | All versions prior to 0.23.15 (introduced at commit 0 / all previous commits affected) | Fixed in 0.23.15 (fix commit 1a21bd71e258438d2511136b5edacc94c08855f4); current PyPI release is 0.24.0[8][0] |
Key takeaways
- Notebook metadata and embedded configuration must be treated as attacker-controlled; marimo's fix moved to an allowlist model that strips ai, mcp, completion, secrets, and server sections supplied by a notebook.[0]
- MCP server configuration embedded in files can become a code-execution vector: an attacker-supplied MCP command ran as a local subprocess merely on opening the notebook in edit mode, without authentication or cell execution.[0][8]
- This is one of several marimo notebook-metadata trust-boundary issues (alongside CVE-2026-67618 API key exfiltration and the earlier CVE-2026-39987 terminal endpoint RCE), underscoring the need to keep the tool current.[0]
Defensive actions
- Upgrade marimo to version 0.23.15 or later (e.g., the current 0.24.0 release).: Version 0.23.15 contains the PEP 723 hardening patch that removes attacker-controlled configuration sections; all prior versions are vulnerable to command execution on notebook open.[0][8]
- Treat notebooks from untrusted sources as potentially malicious and avoid opening them in edit mode on unpatched installations.: The vulnerability triggers when a crafted notebook is opened in edit mode, executing an attacker-controlled command as a local subprocess without any cell being run.[0][8]