Marimo Notebook Metadata Flaw Triggers MCP Subprocess on Edit-Mode Open

The flaw stems from notebook metadata supplying an MCP configuration section that Marimo passes directly to subprocess execution before any cell runs. VulnCheck CNA documentation and OSV imports confirm the command originates from the notebook file itself, bypassing cell execution entirely. This matches the pattern seen in the related CVE-2026-67618 where an AI base_url in the same metadata channel exfiltrated API keys on the next operator request.

Marimo's PEP 723 hardening commit attempted an allowlist that removed ai, mcp, completion, secrets, and server sections yet still left the subprocess path open until the explicit regression test was added. The same researcher credited on both the disclosure and the patch commit indicates the boundary was identified internally but not fully closed on first attempt. Earlier terminal shell exposure in CVE-2026-39987 shows repeated failure to treat notebook-supplied configuration as untrusted.

Notebook environments increasingly serve as default interfaces for AI tooling; an edit-mode vector therefore converts any shared .py or .ipynb file into a reliable execution primitive. Procurement records for research and data-science teams show Marimo adoption rising precisely because of its MCP and AI integrations, amplifying the supply-chain surface.

Operators should verify current version via PyPI and audit any notebooks containing mcp or ai sections in metadata. Continued reliance on post-open execution without strict allowlisting will produce additional CVEs as more protocol extensions are added.